Knowledge + Practice

Microsoft Certified: Azure AI Cloud Developer Associate (AI-200) (AI-200) (AI-200) — Questions 1–75

418 questions total · 6 pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 6

1

MCQeasy

You need to store custom AI container images in a private registry hosted within Azure. Which Azure service provides a managed Docker registry service?

A.Azure Blob Storage

B.Azure Managed Disks

C.Azure Artifacts

D.Azure Container Registry

AnswerD

Azure Container Registry provides a managed, private Docker registry within Azure, storing and versioning container images natively. It satisfies the requirement for private hosting of custom AI container images, integrating with Microsoft Entra ID for authentication and supporting geo-replication, webhooks and tasks for automated image builds.

Why this answer

Azure Container Registry (ACR) is a managed, private Docker registry service that allows you to store and manage container images and artifacts. It supports Docker and OCI images, and integrates with Azure services like AKS, App Service, and Azure Machine Learning. For AI workloads, ACR is the standard place to store custom container images used in training or inference.

Exam trap

AI-200 often tests the confusion between general storage services (Blob Storage) and specialized container registries, or between package managers (Azure Artifacts) and container registries.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage is an object storage service for unstructured data, not a Docker registry; it lacks container image management features like repositories, tags, and Docker API support. Option B is wrong because Azure Managed Disks provides block-level storage volumes for VMs, not a registry for container images. Option C is wrong because Azure Artifacts is a package management service for NuGet, npm, Maven, etc., and does not host Docker container images.

Full explanation →

2

MCQeasy

Which distance metric in Azure Cosmos DB vector search calculates the inner product of two vectors, measuring both magnitude and angle?

A.dotproduct

B.cosine

C.euclidean

D.manhattan

AnswerA

The dotproduct metric computes the inner product of two vectors, combining both magnitude and angle rather than angle alone. This satisfies the stem's requirement for a metric measuring both properties, distinguishing it from cosine, which normalises magnitudes away.

Why this answer

The dotproduct distance metric in Cosmos DB vector search computes the inner product of two vectors, which incorporates both magnitude and angle. It is commonly used when vector magnitudes carry meaning, such as in recommendation systems where popularity or confidence scores matter.

Exam trap

AI-200 often tests the confusion between cosine and dotproduct — the trap is forgetting that cosine ignores magnitude while dotproduct includes it, which changes ranking when vectors are not normalized.

How to eliminate wrong answers

Option B is wrong because cosine similarity measures only the angle between vectors, ignoring magnitude (it normalizes vectors to unit length). Option C is wrong because euclidean distance measures straight-line distance between vector endpoints, not inner product. Option D is wrong because manhattan distance sums absolute differences along each dimension, which is unrelated to inner product.

Full explanation →

3

MCQeasy

You are building a serverless AI workflow that triggers an Azure Function whenever a new file is uploaded to an Azure Blob Storage container. The Function must start processing within seconds of the upload and should not require polling. Which Azure service should you use to connect Blob Storage to the Function?

A.Azure Queue Storage

B.Azure Event Grid

C.Azure Service Bus

D.Azure Event Hubs

AnswerB

Azure Event Grid is a fully managed event routing service that can subscribe to Blob Storage events such as BlobCreated. When a file is uploaded, Event Grid pushes the event to the Function endpoint, providing near real-time, push-based delivery without polling. This is the recommended approach for reactive serverless workflows triggered by Blob Storage changes.

Why this answer

Azure Event Grid natively integrates with Blob Storage to publish events like BlobCreated, and it can push these events directly to an Azure Function. This provides a serverless, push-based trigger that processes files within seconds without polling, making it the correct choice for the scenario.

Exam trap

The trap here is assuming that any messaging service can trigger a Function on Blob Storage upload, when only Event Grid provides native, push-based eventing from Blob Storage.

Full explanation →

4

MCQmedium

You are deploying an AI workload to AKS and want to ensure that pods belonging to your application are distributed across different fault domains (availability zones) for high availability. Which Kubernetes feature should you configure?

A.Resource quotas

B.Topology spread constraints

C.Node taints and tolerations

D.Horizontal Pod Autoscaler

AnswerB

Topology spread constraints let you control how pods distribute across topology domains such as zones, satisfying the availability-zone spread requirement. By setting topologyKey to the zone label and maxSkew, Kubernetes schedules replicas evenly across fault domains, preventing all pods landing in one zone.

Why this answer

Topology spread constraints let you control how pods are distributed across topology domains such as zones or nodes, using label selectors and maxSkew to enforce even spreading. By setting topologyKey to topology.kubernetes.io/zone and a maxSkew of 1, you ensure pods are spread across availability zones, providing fault tolerance if a zone fails.

Exam trap

AI-200 often tests whether candidates confuse scheduling controls — taints/tolerations, affinity, and topology spread constraints — when the requirement is specifically even distribution across fault domains.

How to eliminate wrong answers

Option A is wrong because ResourceQuotas limit aggregate CPU/memory/object counts per namespace and have nothing to do with pod placement across zones. Option C is wrong because taints and tolerations control which nodes a pod can or cannot schedule onto, but they do not enforce even distribution across fault domains. Option D is wrong because Horizontal Pod Autoscaler scales replica count based on metrics, not placement across zones.

Full explanation →

5

Multi-Selecthard

You are evaluating data layer architectures for an enterprise AI application that requires both vector search and structured transactional data management. Which THREE criteria favor choosing Azure Cosmos DB over Azure AI Search as the primary database? (Choose three)

Select 3 answers

A.Need for sub-10 millisecond point reads and writes on operational business records

B.Requirement to store and query arbitrary JSON operational documents alongside vectors

C.Requirement for advanced BM25 keyword search and neural semantic re-ranking

D.Requirement for multi-document ACID transactions within a transactional boundary

E.Requirement to generate automatic PDF text extraction and document chunking via indexers

AnswersA, B, D

Cosmos DB guarantees single-digit millisecond point reads and writes at the 99th percentile for operational records, backed by SLA. Azure AI Search is optimised for query and ranking workloads, not low-latency transactional access to business data.

Why this answer

Option A is correct because Azure Cosmos DB is designed as a low-latency operational database, offering single-digit millisecond point reads and writes (by key and partition key) for business records, whereas Azure AI Search is a search index optimized for query throughput rather than transactional point operations. Option B is correct because Cosmos DB natively stores schema-flexible JSON documents and, with vector indexing/vector search support, can hold operational documents and their embeddings together in the same container. Option D is correct because Cosmos DB supports multi-document ACID transactions within a single logical partition (transactional batch), which Azure AI Search cannot provide since it is not a transactional database.

Option C is not correct because advanced BM25 keyword ranking and neural semantic re-ranking are core capabilities of Azure AI Search, not differentiators of Cosmos DB. Option E is not correct because automatic PDF text extraction, OCR, and document chunking via indexers are Azure AI Search (AI enrichment/indexer) features, not Cosmos DB features.

Exam trap

AI-200 often tests whether candidates can separate the operational database role (Cosmos DB: transactions, point reads, JSON documents) from the search index role (Azure AI Search: BM25, semantic ranker, indexers, skillsets), since both now support vector search and the overlap causes confusion.

Full explanation →

6

Multi-Selecthard

You are troubleshooting a scenario where an Azure App Service hosting an AI frontend cannot communicate with an Azure OpenAI endpoint secured by a private endpoint in a different virtual network. Which THREE of the following networking configurations should you verify? (Choose three)

Select 3 answers

A.Azure Front Door geo-filtering rules blocking all international DNS queries.

B.Virtual network peering between the App Service VNet and the private endpoint VNet.

C.App Service VNet integration enabled so outbound application traffic can route into the VNet.

D.Local admin passwords on the App Service worker instances.

E.Private DNS zone integration (e.g., privatelink.openai.azure.com) linked to the virtual networks.

AnswersB, C, E

A private endpoint resides in its own VNet, so traffic from the App Service VNet must traverse a peering link to reach it. Without peering, routing between the two virtual networks fails, blocking connectivity to the Azure OpenAI private endpoint.

Why this answer

Option B is correct because the App Service VNet and the private endpoint VNet must be peered (or otherwise connected via a gateway/transit) so that traffic can flow between them; without peering, the App Service cannot reach the private endpoint's private IP. Option C is correct because App Service must have regional VNet integration enabled, which routes outbound application traffic from the app into the delegated integration subnet, allowing it to reach the peered VNet and the private endpoint. Option E is correct because the private endpoint's FQDN (e.g., <resource>.privatelink.openai.azure.com) must resolve to the private IP via a private DNS zone linked to the relevant VNets; without this DNS integration, name resolution returns the public IP and the connection fails.

Option A is not relevant because Azure Front Door geo-filtering affects inbound HTTP traffic distribution, not internal DNS resolution or App Service-to-private-endpoint connectivity. Option D is not relevant because local admin passwords on worker instances have no bearing on VNet routing, peering, or private DNS resolution for private endpoint access.

Exam trap

AI-200 often tests the assumption that VNet integration alone is sufficient — candidates forget that private DNS zone linkage is mandatory or that peering must exist between the two VNets.

Full explanation →

7

MCQeasy

You need to review the security recommendations provided by Microsoft for your Azure AI resources, such as enabling HTTPS-only traffic and configuring managed identities. Which Azure tool provides these prioritized security recommendations and a security score?

A.Microsoft Defender for Cloud

B.Azure Cost Management

C.Azure Monitor Metrics

D.Azure Service Health

AnswerA

Microsoft Defender for Cloud continuously assesses Azure AI resources against Microsoft's security benchmarks, surfacing prioritised recommendations such as HTTPS-only traffic and managed identities, plus an aggregated secure score. That directly matches the requested recommendations and scoring capability.

Why this answer

Microsoft Defender for Cloud continuously assesses Azure resources — including Azure AI services — against security benchmarks and produces prioritized recommendations plus a secure score. Recommendations such as enabling HTTPS-only traffic, configuring managed identities, and restricting network access appear directly in Defender for Cloud's regulatory compliance and recommendations blades. This is the tool Microsoft positions for cloud security posture management (CSPM).

Exam trap

AI-200 often tests whether candidates can distinguish security posture management (Defender for Cloud) from operational monitoring (Azure Monitor) and platform health (Service Health), so the trap is picking a monitoring tool for a security-recommendation question.

How to eliminate wrong answers

Option B is wrong because Azure Cost Management analyzes and optimizes spending, not security posture — it has no recommendations about HTTPS or managed identities. Option C is wrong because Azure Monitor Metrics stores and visualizes numeric time-series data (CPU, latency, request counts); it does not generate security recommendations or a security score. Option D is wrong because Azure Service Health reports platform incidents, planned maintenance, and health advisories for Azure services, not per-resource security hardening guidance.

Full explanation →

8

MCQmedium

You are managing an Azure Service Bus Premium namespace. Your application requires strict transactional messaging where a worker receives a message from Queue A, processes it, and sends a resulting message to Queue B. If any step fails, both actions must be rolled back. How should you implement this?

A.Wrap the receive and send operations inside a .NET TransactionScope block.

B.Set the message session ID to the same value on both queues.

C.Enable Event Grid automatic forwarding between queues.

D.Use Event Hubs checkpoints for transactional rollback.

AnswerA

A .NET TransactionScope block enlists both the Queue A receive and Queue B send into a single atomic transaction, so Service Bus rolls back both operations if any step fails, meeting the strict transactional requirement.

Why this answer

In Azure Service Bus, transactional messaging across multiple entities (like receiving from one queue and sending to another) can be achieved using the .NET TransactionScope class. This ensures that both operations are committed or rolled back together.

Exam trap

AI-200 often tests the use of TransactionScope for atomic operations in Service Bus. Candidates might confuse session IDs or auto-forwarding as transactional mechanisms, but only TransactionScope provides rollback.

How to eliminate wrong answers

Option B is wrong because setting the same session ID does not provide transactional rollback; it only ensures ordered processing within a session. Option C is wrong because Event Grid automatic forwarding is not transactional and does not support rollback. Option D is wrong because Event Hubs checkpoints are for stream processing offset management, not for transactional messaging in Service Bus.

Full explanation →

9

MCQhard

Your team is implementing hybrid search in Azure AI Search combining full-text keyword search and vector search. Users report that certain exact product serial numbers are missing from the semantic ranking results. Which query parameter should you adjust to balance the influence of BM25 text search scores against vector cosine similarity scores?

A.Increasing the efSearch parameter in the index definition.

B.Enabling semantic ranking and providing a semanticConfiguration with targeted weight overrides.

C.Adjusting the top parameter to retrieve a larger candidate pool before RRF combination.

D.Switching the vector similarity metric from cosine to euclidean distance.

AnswerB

Adding a semantic configuration with designated title, content, and keyword fields ensures that exact alphanumeric serial numbers are correctly captured via secondary lexical boosting and reranked properly.

Why this answer

When performing hybrid queries in Azure AI Search, the search engine uses Reciprocal Rank Fusion (RRF) to combine results from text and vector searches. You can influence the weighting or use standard RRF parameters, but adjusting semantic ranking configurations or ensuring proper semantic configuration boosts can address relevance blending. Specifically, adjusting query parameters like semantic configuration or custom scoring profiles allows fine-tuning.

Full explanation →

10

MCQmedium

You are building an order processing system with Azure Service Bus. Multiple clients might accidentally submit the exact same order twice within a 60-second window due to network retries. You need to prevent duplicate orders from entering the queue. What should you configure?

A.Enable Duplicate Detection on the queue and set the history time window to 60 seconds.

B.Configure Auto-Forwarding to a dead-letter queue with a 60-second TTL.

C.Set the LockDuration property to 60 seconds.

D.Enable partitioning and set the partition key to the client IP address.

AnswerA

Service Bus duplicate detection uses the MessageId to identify and discard repeated messages within a configurable history window. Setting the window to 60 seconds covers the retry interval, preventing the same order from being enqueued twice.

Why this answer

Azure Service Bus Duplicate Detection uses a DuplicateDetectionHistoryTimeWindow to track MessageId values of recently sent messages. When enabled, the broker rejects messages with the same MessageId within the specified window. Setting the window to 60 seconds ensures that duplicate orders submitted within that timeframe are discarded, preventing duplicates from entering the queue.

Exam trap

AI-200 often tests the misconception that message locks or TTL settings prevent duplicates, when the correct feature is Duplicate Detection with a history time window.

How to eliminate wrong answers

Option B is wrong because Auto-Forwarding to a dead-letter queue with a TTL does not detect duplicates; it simply moves expired messages, and duplicates would still be processed. Option C is wrong because LockDuration controls how long a receiver can lock a message, not duplicate detection. Option D is wrong because partitioning with a partition key based on client IP does not prevent duplicates; it only distributes load and does not compare message IDs.

Full explanation →

11

MCQmedium

Your application uses Azure Service Bus Queues. A spike in traffic causes multiple worker instances to contend for messages. You want to ensure that when a worker locks a message, no other worker can process it, and the lock is automatically renewed in the background if processing takes longer than expected. Which client library feature should you use?

A.Enable Auto-Lock Renewal on the message processor client.

B.Increase the LockDuration property on the queue to 2 hours permanently.

C.Use Event Grid advanced filters to throttle incoming messages.

D.Switch the queue to ReceiveAndDelete mode.

AnswerA

Auto-Lock Renewal extends the PeekLock before expiry, preventing lock loss and duplicate processing by other workers during long runs. Combined with PeekLock's exclusive lock, it satisfies the stem's requirement that no other worker processes the message.

Why this answer

Auto-Lock Renewal is a feature of the Service Bus message processor client (e.g., ServiceBusProcessor in .NET, ServiceBusProcessorClient in Java) that automatically extends the message lock in the background while the handler is still processing. This prevents lock expiration and message redelivery to other workers during long-running processing.

Exam trap

AI-200 often tests the difference between lock renewal (dynamic, per-message) and LockDuration (static, queue-level) — candidates pick the static LockDuration increase because it seems simpler, missing that auto-renewal is the adaptive, correct solution.

How to eliminate wrong answers

Option A is correct. Option B is wrong because permanently setting LockDuration to 2 hours is a blunt, static workaround that affects all messages and can delay redelivery of genuinely failed messages for up to 2 hours — it does not adapt to actual processing time. Option C is wrong because Event Grid advanced filters apply to Event Grid subscriptions, not Service Bus queues, and they filter events rather than throttle message consumption.

Option D is wrong because ReceiveAndDelete mode removes the message from the queue immediately upon receipt, eliminating the lock entirely and providing at-most-once delivery — the opposite of what is needed for reliable processing.

Full explanation →

12

MCQhard

You are troubleshooting slow inference latency in an AI application deployed on AKS. You suspect that network packets between inference pods are traversing unnecessary hops due to overlay routing. Which CNI mode should you have chosen for optimal direct routing?

A.Azure CNI with direct pod IP routing (no overlay)

B.Kubenet with host-port mapping

C.Kubenet with basic Linux bridge

D.Azure CNI Overlay

AnswerA

Azure CNI assigns each pod a routable IP from the virtual network subnet, so pod-to-pod traffic is delivered directly without VXLAN encapsulation or overlay hops, cutting the extra latency the stem attributes to overlay routing.

Why this answer

Azure CNI with direct pod IP routing assigns each pod a routable IP from the VNet subnet, so pod-to-pod traffic is routed natively by the Azure SDN fabric without encapsulation. This eliminates the overlay tunnel (VXLAN) hops that add latency and MTU overhead. For latency-sensitive inference traffic, direct routing is the optimal CNI choice.

Exam trap

AI-200 often tests the confusion between Azure CNI Overlay (IP-conserving but encapsulated) and Azure CNI direct routing (IP-consuming but hop-free), tricking candidates who assume 'overlay' means faster.

How to eliminate wrong answers

Option B is wrong because Kubenet uses a Linux bridge and host-port mapping with NAT, forcing pod traffic through the node's network stack and adding hops and address translation. Option C is wrong because Kubenet with a basic Linux bridge still relies on the Kubenet overlay-style routing and does not give pods first-class VNet IPs, so traffic is not directly routed. Option D is wrong because Azure CNI Overlay encapsulates pod traffic in VXLAN tunnels over the underlay, which is exactly the overlay routing that introduces the extra hops the scenario wants to avoid.

Full explanation →

13

MCQmedium

You have an AI workload that requires persistent storage for large model checkpoints. Which storage type should you mount to an AKS pod for optimal performance?

A.Azure Disk (Premium).

B.Azure Files (Standard).

C.Ephemeral OS Disk.

D.Azure Blob Storage (container mount).

AnswerA

Azure Disk (Premium) provides SSD-backed block storage with low latency and high IOPS, satisfying the stem's requirement for persistent storage of large model checkpoints with optimal performance. It is ReadWriteOnce, so it attaches to a single pod, unlike Azure Files.

Why this answer

Azure Disk (Premium) is the correct choice because it provides low-latency, high-IOPS block storage that can be mounted as a ReadWriteOnce volume to an AKS pod via a PersistentVolumeClaim. For large model checkpoints that require fast sequential and random I/O during training or inference, Premium SSD-backed Azure Disks deliver the performance Azure Files Standard cannot match.

Exam trap

AI-200 often tests whether candidates pick Azure Files for 'persistent storage' without considering performance — the key differentiator is that block storage (Azure Disk Premium) is required for high-IOPS checkpoint workloads.

How to eliminate wrong answers

Option B is wrong because Azure Files (Standard) is SMB-based network storage with higher latency and lower IOPS, making it unsuitable for performance-sensitive checkpoint I/O. Option C is wrong because an Ephemeral OS Disk is tied to the node's lifecycle and is used for the OS, not for persistent data — it is lost when the node is deallocated. Option D is wrong because Azure Blob Storage mounted as a container (e.g., via Blob CSI driver) is object storage with higher latency and is better for read-heavy, infrequent-access workloads, not high-performance checkpoint writes.

Full explanation →

14

MCQhard

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

A.Azure Cost Management amortization tables

B.Azure Storage blob access audit logs

C.Azure Key Vault secret version history

D.Azure Active Directory sign-in logs or AzureDiagnostics table capturing managed identity token requests

AnswerD

Microsoft Entra ID sign-in logs and the AzureDiagnostics table record managed identity token requests, including HTTP status codes and error descriptions. Analysing these satisfies the requirement to inspect exact token acquisition failures rather than application-level or activity-log entries.

Why this answer

Token acquisition failures against Azure AD (Entra ID) are logged in the Azure AD sign-in logs and, for managed identity token requests, in the AzureDiagnostics table within Log Analytics. These logs capture the exact HTTP status codes (e.g., 400, 401, 403) and error descriptions such as AADSTS error codes returned during the OAuth 2.0 client credentials flow. Analyzing these tables lets you pinpoint whether the failure is due to misconfigured credentials, missing role assignments, or conditional access policies.

Exam trap

AI-200 often tests the confusion between resource-level diagnostic logs (like blob access or Key Vault audit) and identity-level logs, tricking candidates into selecting storage or vault logs when the failure is fundamentally an authentication/token issue.

How to eliminate wrong answers

Option A is wrong because Azure Cost Management amortization tables contain billing and usage cost data, not authentication or token acquisition telemetry. Option B is wrong because Azure Storage blob access audit logs record blob read/write/delete operations, not Azure AD token issuance events. Option C is wrong because Key Vault secret version history tracks secret lifecycle and versioning metadata, not HTTP status codes from token endpoint calls.

Full explanation →

15

MCQmedium

Your team is building an analytics pipeline where IoT telemetry data is ingested via Azure Event Hubs and needs to be continuously archived in Parquet format to an Azure Data Lake Storage Gen2 account for AI model training. Which built-in feature of Event Hubs should you enable?

A.Service Bus Geo-Replication

B.Event Grid Auto-Routing

C.Event Hubs Capture

D.Stream Analytics Integration Job

AnswerC

Event Hubs Capture automatically packages streaming telemetry into storage blobs without requiring custom worker code.

Why this answer

Event Hubs Capture allows you to automatically capture streaming data in Event Hubs and save it to an Azure Blob Storage or Azure Data Lake Storage Gen2 account in Avro or Parquet format.

Full explanation →

16

MCQmedium

You are configuring continuous deployment for an AI model container. Whenever a data scientist pushes code to a GitHub repository, you want Azure Container Registry to automatically build and tag the new container image without managing an external CI/CD build agent. What should you use?

A.Azure DevOps self-hosted build agent running on a VM

B.ACR Tasks with automated source code triggers

C.Azure Logic Apps polling GitHub webhooks

D.An AKS deployment controller pod

AnswerB

ACR Tasks with source triggers builds and tags images automatically on GitHub commits, using ACR's own managed build infrastructure. This removes the need to provision or maintain an external CI/CD build agent, matching the stated constraint.

Why this answer

ACR Tasks supports automated builds triggered by source code commits to GitHub or Azure DevOps, executing the docker build inside Azure without requiring you to manage a build agent. You configure a task with a source trigger (e.g., on commit to a branch) and ACR builds, tags, and optionally pushes the image automatically. This matches the requirement for CI/CD without external build infrastructure.

Exam trap

AI-200 often tests whether candidates know ACR Tasks is a native, agentless build service — the trap is choosing Azure DevOps or Logic Apps because 'CI/CD' is associated with those tools, missing that ACR Tasks handles the build internally.

How to eliminate wrong answers

Option A is wrong because a self-hosted Azure DevOps agent on a VM requires you to provision, patch, and manage the build VM — the opposite of 'without managing an external CI/CD build agent.' Option C is wrong because Logic Apps polling GitHub webhooks is a generic automation pattern that does not natively build or tag container images; you would still need a build engine. Option D is wrong because an AKS deployment controller pod manages workload scheduling and reconciliation inside a cluster, not source-triggered image builds.

Full explanation →

17

MCQhard

You manage an Azure Cosmos DB for NoSQL container that stores product documents with a vector embedding property. You need to query for products similar to a given embedding while also filtering by a category partition key. Which query approach should you use?

A.Use a stored procedure that loads all documents and computes cosine similarity in JavaScript.

B.Use a user-defined function that calls an external Azure AI Search service.

C.Use a SQL query with VectorDistance and a WHERE clause on the partition key.

D.Use the MongoDB API's $vectorSearch aggregation stage.

AnswerC

Cosmos DB for NoSQL supports the VectorDistance function in SQL queries. Combining it with a filter on the partition key restricts the search to a single logical partition, improving performance and reducing RU cost. This is the recommended way to perform vector similarity search with additional filters.

Why this answer

Cosmos DB for NoSQL provides the VectorDistance function for vector similarity search directly in SQL queries. When you also filter on the partition key, the query is scoped to a single logical partition, which optimizes performance and RU consumption. This is the most efficient and supported method for combining vector search with attribute filters.

Exam trap

The trap here is thinking that vector search in Cosmos DB for NoSQL requires external services or custom code, when the native VectorDistance function supports it directly.

Full explanation →

18

MCQhard

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

A.Enable Application Insights dependency tracking on the subscription level via Azure Policy

B.Configure diagnostic settings on each AI service resource pointing to the centralized Log Analytics workspace

C.Configure Azure Event Grid subscriptions for every log event emitted by the AI endpoints

D.Deploy a Log Analytics agent (MMA) directly onto the Azure OpenAI PaaS resource instances

AnswerB

Diagnostic settings are configured per resource, so each Azure OpenAI and Azure AI Language resource needs its own setting pointing at the shared Log Analytics workspace. This centralises logs and metrics across resource groups without moving or recreating the services.

Why this answer

Diagnostic settings are the native Azure mechanism for routing resource-level platform logs and metrics from individual PaaS resources (such as Azure OpenAI and Azure AI Language) to a Log Analytics workspace, Storage account, or Event Hub. Because diagnostic settings are configured per resource and can target a workspace in any resource group or subscription (as long as the caller has appropriate RBAC), this is the correct way to centralize telemetry across resource groups.

Exam trap

The trap here is confusing application-level telemetry (Application Insights) or event routing (Event Grid) with resource-level platform diagnostics, causing candidates to pick a mechanism that cannot actually export Azure OpenAI/AI Language logs and metrics.

How to eliminate wrong answers

Option A is wrong because Application Insights dependency tracking is an application-level APM feature that captures outbound calls from instrumented apps, not the platform diagnostic logs and metrics of the Azure OpenAI or AI Language resources themselves, and Azure Policy cannot 'enable' dependency tracking at subscription scope. Option C is wrong because Event Grid delivers discrete resource events (e.g., blob created, resource updated), not the full diagnostic log/metric stream, and you would still need diagnostic settings to emit those logs. Option D is wrong because the Log Analytics agent (MMA) is for IaaS VMs and on-premises servers; it cannot be installed on PaaS resources like Azure OpenAI, which expose logs only via diagnostic settings.

Full explanation →

19

Multi-Selecthard

You are troubleshooting slow query performance in an enterprise Azure AI Search vector deployment. Which THREE architectural or configuration adjustments can improve query throughput and latency? Choose three.

Select 3 answers

A.Scale out the number of search service replicas

B.Replace all vector fields with standard ASCII folding tokenizers

C.Ensure the search service is deployed on a Standard tier or higher with adequate RAM

D.Tune the efSearch parameter lower to trade off marginal recall for faster search traversal

E.Configure the index to use exhaustive KNN exclusively for high-QPS production workloads

AnswersA, C, D

Adding replicas distributes query load across more nodes, directly raising concurrent query throughput and reducing per-query latency. This satisfies the stem's throughput and latency constraint, since replicas serve read traffic in parallel while the index partition count stays fixed.

Why this answer

Option A is correct because adding replicas to an Azure AI Search service distributes query load across more nodes, directly increasing query throughput (QPS) and reducing per-query latency, since each replica holds a full copy of the index and can serve queries independently. Option C is correct because vector search is memory-intensive: the HNSW graph and vector indexes must reside in RAM, so deploying on Standard tier or higher (rather than Basic/Free, which have limited memory and no vector support at scale) ensures adequate RAM to avoid disk-bound traversal and throttling. Option D is correct because lowering the efSearch parameter reduces the size of the HNSW candidate list explored during query-time traversal, trading a small amount of recall for faster search and lower latency, which is a standard tuning lever for throughput-sensitive vector workloads.

Option B is not correct because ASCII folding tokenizers apply to text/lexical fields, not vector fields, and cannot replace vector embeddings or improve vector similarity search. Option E is not correct because exhaustive KNN scans the entire vector space and is far slower than HNSW approximate search, making it unsuitable for high-QPS production workloads.

Exam trap

The trap is treating exhaustive KNN as a 'more accurate' upgrade for production — candidates pick it thinking accuracy always wins, but the exam tests whether you know exhaustive search destroys QPS and is only appropriate for small indexes or offline evaluation.

Full explanation →

20

MCQhard

Your enterprise application uses Azure Service Bus Topics to broadcast AI model inference updates to multiple microservices. One particular subscriber requires filtering messages so it only receives updates where the 'ModelVersion' property is equal to 'v2' and the 'ConfidenceScore' is greater than 0.85. How should you implement this?

A.Create a boolean filter on the subscription matching a correlation ID of 'v2'.

B.Write custom middleware in the subscriber service to drop messages that do not meet the criteria after reading them from the topic.

C.Configure an Event Grid custom filter using advanced filters with an 'And' operator.

D.Create a SQL filter on the Service Bus subscription with the expression ModelVersion = 'v2' AND ConfidenceScore > 0.85.

AnswerD

SQL filters evaluate broker-side Boolean expressions against message properties, so ModelVersion = 'v2' AND ConfidenceScore > 0.85 is applied before delivery. This satisfies the stem's compound filtering constraint, which correlation filters cannot express because they only match exact property values.

Why this answer

Azure Service Bus subscriptions support SQL filters that evaluate against both system properties and user-defined custom properties (also called application properties) on the message. Because 'ModelVersion' and 'ConfidenceScore' are custom properties set by the publisher, a SQL filter expression like ModelVersion = 'v2' AND ConfidenceScore > 0.85 evaluates server-side at the subscription, so only matching messages are delivered to that subscriber. This is the native, most efficient mechanism for content-based routing on Service Bus Topics.

Exam trap

AI-200 often tests the misconception that subscriber-side middleware or Event Grid filters can replace native Service Bus subscription filters, when the correct answer is always the broker-side SQL filter for content-based routing on Service Bus Topics.

How to eliminate wrong answers

Option A is wrong because a boolean filter (TrueFilter/FalseFilter) only accepts or rejects all messages and cannot evaluate a correlation ID against a custom property like ModelVersion — correlation filters match only the CorrelationId system property, not arbitrary application properties. Option B is wrong because filtering after the subscriber reads the message means every message is still delivered to every subscriber, wasting bandwidth and compute, and it defeats the purpose of the topic/subscription fan-out model. Option C is wrong because Event Grid custom filters apply to Event Grid events, not Service Bus messages, and Event Grid is a separate eventing service — it cannot filter Service Bus topic subscriptions.

Full explanation →

21

MCQhard

You are designing an AI inference pipeline that publishes prediction results to an Azure Event Hubs namespace with four partitions. A downstream Azure Function must process events in the exact order they were produced for each customer ID, and the pipeline must scale to handle increasing load. The customer ID is included in the event body as a property. What should you do to guarantee per-customer ordering while maximizing throughput?

A.Set the partition key to the customer ID when publishing events, and have each Function instance process a single partition.

B.Publish events without a partition key and enable the Event Hubs capture feature to archive events in order.

C.Enable the Event Hubs deduplication feature and set a sequence number on each event before publishing.

D.Use a single partition for the Event Hubs namespace and scale the Function with multiple instances reading from that partition.

AnswerA

Event Hubs guarantees ordering only within a partition. By setting the partition key to the customer ID, all events for a given customer are routed to the same partition, preserving order. Having each Function instance read from a single partition ensures sequential processing per partition, which maintains per-customer order while allowing the four partitions to be processed in parallel for throughput.

Why this answer

Ordering in Event Hubs is guaranteed only within a partition. Setting the partition key to the customer ID ensures all events for that customer go to the same partition, and having each Function instance read from a single partition preserves sequential processing. This design also allows the four partitions to be processed concurrently, meeting the scaling requirement.

Exam trap

The trap here is believing that Event Hubs offers global ordering or that a single partition with multiple readers can scale, when ordering is per-partition and a partition supports only one active reader per consumer group.

Full explanation →

22

Multi-Selectmedium

You are configuring an Azure Service Bus Topic and Subscriptions for an AI text classification system. Which THREE filter types are supported on Service Bus subscriptions for routing messages? Each correct answer represents a valid filter type.

Select 3 answers

A.Boolean Filters (True/False filters)

B.Regex Pattern Matching Filters

C.Machine Learning Inference Filters

D.SQL Filters

E.Correlation Filters

AnswersA, D, E

Boolean filters are the TrueFilter and FalseFilter, which match all messages or none respectively, giving subscriptions an unconditional catch-all or complete block. They are a supported Service Bus subscription filter type, distinct from SQL and correlation filters.

Why this answer

Service Bus subscriptions support exactly three filter types: Boolean filters, SQL filters, and Correlation filters. Option A (Boolean Filters) is correct because a TrueFilter (1=1) captures all messages to a subscription and a FalseFilter (1=0) blocks all messages, which is useful for a catch-all or disabled subscription in the classification pipeline. Option D (SQL Filters) is correct because they use SQL-like expressions evaluated against message system and user properties (for example, sys.Label='sports' AND priority>5), enabling content-based routing of text classification messages.

Option E (Correlation Filters) is correct because they match on properties such as CorrelationId, MessageId, Label, ReplyTo, and custom properties, providing efficient exact-match routing for AI workloads. Option B (Regex Pattern Matching Filters) is not a supported Service Bus filter type, and Option C (Machine Learning Inference Filters) does not exist as a native subscription filter; both are invalid for this scenario.

Exam trap

AI-200 often tests the exact set of Service Bus filter types, and candidates pick regex or ML-based filters because they sound advanced — the trap is not knowing that only Boolean, SQL, and Correlation filters exist.

Full explanation →

23

Multi-Selecthard

You are implementing a robust data layer architecture for an enterprise generative AI application. Which THREE factors should you evaluate when deciding between Azure AI Search and Azure Cosmos DB for vector search? (Choose three)

Select 3 answers

A.Need for automated multi-region replication with single-digit millisecond latency reads

B.Need for advanced full-text search, BM25 ranking, and semantic re-ranking

C.Requirement to run Hadoop MapReduce jobs directly over the vector indexes

D.Requirement to store vector embeddings as relational SQL tables with foreign key constraints

E.Requirement for low-latency transactional CRUD operations alongside vector search

AnswersA, B, E

Cosmos DB natively supports turnkey multi-region replication with single-digit millisecond read latency through its global distribution model. Azure AI Search does not offer equivalent automatic multi-region write replication, so this factor favours Cosmos DB when that latency and replication profile is required.

Why this answer

Option A is correct because Azure Cosmos DB is designed for global distribution with turnkey multi-region replication and single-digit millisecond read/write latencies at the 99th percentile, which is a decisive factor when the vector store must serve globally distributed users; Azure AI Search does not provide the same multi-master, multi-region replication model. Option B is correct because Azure AI Search natively provides full-text search with BM25 ranking, scoring profiles, and semantic re-ranking (semantic ranker/L2 reranking), capabilities that Cosmos DB's vector search does not offer out of the box. Option E is correct because Cosmos DB is a transactional NoSQL database offering low-latency CRUD operations (point reads/writes, optimistic concurrency via ETags) in the same store as vector indexes, which matters when the application must mutate documents and query embeddings together.

Option C is not relevant because neither service runs Hadoop MapReduce jobs directly over vector indexes, and vector search is not a MapReduce workload. Option D is incorrect because Cosmos DB is a NoSQL document database, not a relational engine with SQL tables and foreign key constraints, and Azure AI Search is not relational either.

Exam trap

AI-200 often tests the misconception that either service supports relational or Hadoop-style analytics, when the real decision factors are replication/latency, full-text ranking, and transactional CRUD.

Full explanation →

24

MCQeasy

Which Azure feature allows you to set up a private, internal-only container registry?

A.Azure Private Link.

B.Azure Bastion.

C.Public access with firewall rules.

D.VPN Gateway.

AnswerA

Azure Private Link provisions a private endpoint with a private IP inside your virtual network, so the registry is reachable only over the internal network and never exposed to the public internet. This delivers the internal-only access the scenario demands.

Why this answer

Azure Private Link allows you to create a private endpoint for an Azure Container Registry (ACR), which assigns a private IP address from your virtual network. This makes the registry accessible only from within your VNet or connected networks, eliminating public internet exposure. It provides internal-only access without requiring public IPs or exposing the registry to the internet.

Exam trap

AI-200 often tests the misconception that a VPN Gateway or firewall rules alone can provide internal-only access to a PaaS service, when in fact Azure Private Link is the dedicated feature for private endpoints.

How to eliminate wrong answers

Option B is wrong because Azure Bastion is a service that provides secure RDP/SSH access to virtual machines, not a mechanism for creating private endpoints for container registries. Option C is wrong because public access with firewall rules still exposes the registry to the internet, albeit with restricted IP ranges; it does not provide an internal-only private endpoint. Option D is wrong because VPN Gateway is used to establish encrypted connections between on-premises networks and Azure VNets, but it does not directly make a container registry internal-only; it only provides network connectivity, not private endpoint isolation.

Full explanation →

25

MCQhard

You are troubleshooting intermittent network timeout errors between microservices in an AKS cluster running an AI pipeline. You suspect that network policies are blocking required inter-pod communication. Which CNI plugin must be configured in AKS to enforce these network policies?

A.Azure CNI with Azure Network Policies or Calico enabled

B.Kubernetes standard kube-proxy in IPVS mode only

C.Azure Virtual Network NAT Gateway

D.Kubenet basic networking without network policies

AnswerA

Azure CNI alone does not enforce Kubernetes NetworkPolicy objects; enabling either Azure Network Policies or Calico as the policy engine provides the enforcement plane that filters inter-pod traffic, satisfying the requirement to block or permit specific microservice communication.

Why this answer

AKS network policies are only enforced when the cluster uses Azure CNI (or Azure CNI Overlay) with a policy engine — either Azure Network Policy Manager or Calico — enabled at cluster creation. Kubenet does not support NetworkPolicy enforcement, and kube-proxy/NAT Gateway are unrelated to pod-level policy enforcement. Therefore Azure CNI plus Azure Network Policies or Calico is the required configuration.

Exam trap

AI-200 often tests the misconception that any CNI (including kubenet) can enforce NetworkPolicy — candidates forget that AKS requires Azure CNI plus a policy engine (Azure NPM or Calico) for enforcement to actually work.

How to eliminate wrong answers

Option B is wrong because kube-proxy in IPVS mode only handles service load-balancing (ClusterIP/NodePort translation), not NetworkPolicy enforcement — it has no policy engine. Option C is wrong because Azure NAT Gateway provides outbound SNAT for subnet traffic and has nothing to do with pod-to-pod policy enforcement. Option D is wrong because kubenet is a basic overlay that does not support NetworkPolicy at all; AKS explicitly requires Azure CNI (or Calico on Azure CNI) for policy enforcement.

Full explanation →

26

MCQmedium

You are configuring vector search in Azure Cosmos DB for NoSQL. You want to ensure that vectors are indexed using the DiskANN algorithm for high recall and fast search performance. Which index type should you specify in the vector embedding policy?

A.faissHNSW

B.diskANN

C.hnsw

D.ivfFlat

AnswerB

Specifying diskANN in the vector embedding policy configures Cosmos DB for NoSQL to build the DiskANN index, which delivers high recall and low-latency approximate nearest-neighbour search. Other index types, such as flat or quantizedFlat, do not provide the same performance at scale.

Why this answer

Azure Cosmos DB for NoSQL supports the DiskANN algorithm for vector indexing, which is specified as `diskANN` in the vector embedding policy. DiskANN is optimized for high recall and low-latency search on large-scale vector datasets, making it the correct choice for the requirement.

Exam trap

AI-200 often tests whether candidates assume that common vector index names like HNSW or IVF are supported in Cosmos DB, but the only supported index type for NoSQL vector search is DiskANN.

How to eliminate wrong answers

Option A is wrong because `faissHNSW` is not a valid index type in Cosmos DB's vector embedding policy; FAISS is a separate library and not an option in Cosmos DB. Option C is wrong because `hnsw` is not a supported index type in Cosmos DB for NoSQL vector search; while HNSW is a common algorithm, Cosmos DB uses DiskANN. Option D is wrong because `ivfFlat` is an inverted file index variant not offered by Cosmos DB's vector search feature.

Full explanation →

27

Multi-Selecthard

You are designing an event-driven architecture that needs to integrate multiple Azure services. Which THREE statements accurately describe the ideal use cases for Azure Event Grid, Azure Service Bus, and Azure Event Hubs respectively? (Choose three)

Select 3 answers

A.Azure Event Hubs is designed for high-throughput big data streaming and telemetry ingestion pipelines.

B.Azure Event Grid is designed for high-speed Kafka protocol big data telemetry streaming.

C.Azure Event Grid is optimized for reactive event distribution and pub/sub routing across Azure services.

D.Azure Service Bus is optimized for stateless event notifications with sub-millisecond webhook delivery.

E.Azure Service Bus is designed for enterprise transactional messaging, queues, topics, and strict ordering.

AnswersA, C, E

Event Hubs partitions a high-volume event stream for replayable, ordered consumption by multiple downstream readers, making it the fit for telemetry and big-data ingestion where throughput, retention and consumer groups matter rather than per-message routing or transactions.

Why this answer

Option A is correct because Azure Event Hubs is a big-data streaming platform built for ingesting millions of events per second from telemetry, logs, and IoT sources into pipelines like Azure Stream Analytics or Spark. Option C is correct because Azure Event Grid is a reactive, push-based pub/sub service that routes discrete event notifications from Azure resource events and custom topics to subscribers such as Functions, Logic Apps, and webhooks. Option E is correct because Azure Service Bus provides enterprise brokering with queues, topics/subscriptions, sessions, transactions, dead-lettering, and guaranteed FIFO ordering via sessions.

Option B is wrong because Kafka-protocol streaming is a feature of Event Hubs (Kafka endpoint), not Event Grid. Option D is wrong because Service Bus is a brokered messaging service with at-least-once delivery and store-and-forward semantics, not a stateless sub-millisecond webhook notifier like Event Grid.

Exam trap

AI-200 often tests the Kafka protocol confusion — candidates assume Event Grid supports Kafka because it sounds like a streaming service, but only Event Hubs offers the Kafka-compatible endpoint.

Full explanation →

28

Multi-Selectmedium

You are troubleshooting an AI inference container deployed in Azure Container Apps that is failing health probes. Which TWO diagnostic tools or logs can you examine in the Azure portal to investigate the failure?

Select 2 answers

A.Log stream in the Azure portal for the container app replica

B.Azure Bastion connection to the container host VM

C.Container Apps console for interactive terminal access

D.AKS control plane audit logs

E.Azure Storage Account blob container metrics

AnswersA, C

The log stream surfaces real-time stdout and stderr from the failing replica, revealing why the readiness or liveness probe returns errors. It directly addresses the health probe failure by exposing container startup and runtime output without redeploying.

Why this answer

Option A, the Log stream in the Azure portal for the container app replica, is correct because Azure Container Apps exposes real-time stdout/stderr and system logs per replica, letting you see probe failures, application startup errors, and health endpoint responses directly. Option C, the Container Apps console for interactive terminal access, is correct because it opens a shell session inside the running container (via the platform's built-in exec capability), so you can manually curl the health endpoint, inspect environment variables, check listening ports, and verify the process is running. Option B is wrong because Azure Bastion connects to Azure VMs, not to Container Apps, which run on a managed serverless platform without a directly accessible host VM.

Option D is wrong because AKS control plane audit logs apply to Azure Kubernetes Service clusters, not to Container Apps. Option E is wrong because Azure Storage blob metrics report on storage account usage and performance, which are unrelated to container health probe failures.

Exam trap

The trap is mixing up AKS and Container Apps diagnostics: candidates may pick AKS control plane audit logs or Bastion because they sound like 'container' tools, but Container Apps has its own log stream and console surfaces.

Full explanation →

29

MCQeasy

Your enterprise requires that all container images deployed to Azure Kubernetes Service (AKS) must originate from approved corporate Azure Container Registries (ACRs). How can you enforce this restriction cluster-wide?

A.Configure standard Kubernetes Network Policies in the kube-system namespace

B.Configure Azure Policy for Kubernetes with the built-in initiative to restrict container registries

C.Set up ACR webhook notifications to trigger Azure Functions that delete unauthorized pods

D.Modify the kubelet configuration file on every cluster node manually

AnswerB

Azure Policy for Kubernetes applies admission control through the Gatekeeper webhook, denying pods whose images fall outside the allowed registry list. The built-in initiative enforces this cluster-wide, satisfying the requirement that only approved corporate ACRs be used.

Why this answer

Azure Policy for Kubernetes extends Gatekeeper/OPA into AKS, allowing cluster-wide admission control that blocks pods whose images do not match approved ACR patterns. The built-in initiative 'Kubernetes cluster containers should only use allowed images' enforces this at admission time, before workloads are scheduled. This is the native, declarative, auditable mechanism Microsoft provides for exactly this governance requirement.

Exam trap

AI-200 often tests the misconception that Kubernetes Network Policies can enforce image-source restrictions, when in reality only admission controllers (Azure Policy/Gatekeeper) operate at that layer.

How to eliminate wrong answers

Option A is wrong because Kubernetes Network Policies only control L3/L4 ingress/egress traffic between pods and namespaces — they have no visibility into image registry origins and cannot block a pod based on where its image came from. Option C is wrong because ACR webhooks are reactive notifications (push/delete events) and Azure Functions deleting pods after the fact is a remediation hack, not enforcement — unauthorized images would still run before deletion, and the approach is fragile and non-declarative. Option D is wrong because manually editing kubelet config on every node is unsupported in AKS (nodes are managed and reimaged), does not scale, and kubelet itself does not enforce image-source allowlists.

Full explanation →

30

MCQmedium

You are using Application Insights to monitor a Retrieval-Augmented Generation (RAG) application. You need to log custom dimensions such as prompt token counts and user IDs alongside standard telemetry. Which class should you use in your C# application?

A.Configure the AzureMonitorLogExporter in the standard logging pipeline.

B.Use the TelemetryClient class and its TrackEvent method with a dictionary of custom dimensions.

C.Use the DiagnosticSource class to emit unstructured string logs to Console.

D.Use the AzureKeyVaultClient to store transient custom properties.

AnswerB

TelemetryClient.TrackEvent accepts a properties dictionary, letting you attach prompt token counts and user IDs as custom dimensions to Application Insights events. This satisfies the requirement to log custom dimensions alongside standard telemetry from the C# RAG application.

Why this answer

The TelemetryClient class in the Application Insights SDK is the primary API for sending custom telemetry, and its TrackEvent method accepts a dictionary of custom dimensions (properties) that are indexed and queryable in Application Insights. This allows you to attach arbitrary key-value pairs such as prompt token counts and user IDs to a custom event, which then appear as customDimensions in the telemetry schema. Unlike plain logging, this approach preserves structured data and integrates with the full Application Insights analytics and filtering capabilities.

Exam trap

AI-200 often tests the distinction between structured telemetry via TelemetryClient and unstructured logging or unrelated services, so candidates may mistakenly choose logging exporters or key vaults for custom dimensions.

How to eliminate wrong answers

Option A is wrong because AzureMonitorLogExporter is an OpenTelemetry exporter that forwards logs to Azure Monitor, but it does not provide a direct, structured way to attach custom dimensions to individual telemetry items in the Application Insights SDK model; it is used for exporting existing log records, not for creating custom events with properties. Option C is wrong because DiagnosticSource emits unstructured string logs to listeners like Console, which lack the structured custom dimensions and Application Insights integration required for queryable telemetry. Option D is wrong because AzureKeyVaultClient is for managing secrets and keys, not for storing or transmitting telemetry data; using it for custom properties would be an architectural anti-pattern and would not surface the data in Application Insights.

Full explanation →

31

MCQmedium

You are troubleshooting intermittent HTTP 429 (Too Many Requests) errors from an Azure OpenAI deployment. Which metric in Azure Monitor should you inspect to confirm whether token rate limits are being exceeded?

A.System Assigned Managed Identity Success Rate

B.Virtual Network Gateway Packet Drops

C.Data Ingestion Volume (GB)

D.Normalized Token Utilization

AnswerD

Normalized Token Utilization expresses consumed tokens as a percentage of the deployment's allocated token-per-minute quota, so sustained values near 100% confirm rate limiting. Raw token counts alone cannot distinguish throttling from normal load, making this the precise throttling indicator.

Why this answer

Normalized Token Utilization is the Azure OpenAI metric that expresses consumed tokens as a percentage of the deployment's tokens-per-minute (TPM) quota. When it approaches or exceeds 100%, the service returns HTTP 429, so this metric directly confirms whether rate limits are the cause.

Exam trap

AI-200 often tests whether candidates confuse authentication, networking, or ingestion metrics with quota metrics — the phrase 'token rate limits' is the tell for Normalized Token Utilization.

How to eliminate wrong answers

Option A is wrong because managed identity success rate relates to authentication token acquisition, not OpenAI request throttling. Option B is wrong because Virtual Network Gateway packet drops indicate network-layer issues, not application-level rate limiting. Option C is wrong because Data Ingestion Volume measures log/data ingestion into Log Analytics, unrelated to OpenAI token quotas.

Full explanation →

32

MCQhard

You are managing an Azure Cosmos DB for NoSQL database containing vector embeddings. You need to perform a migration of embeddings from one container to another without taking the application offline. Which Azure feature should you use?

A.Azure Cosmos DB Change Feed processor

B.Azure Data Factory tumbling window triggers over Blob Storage

C.SQL Server Integration Services (SSIS) file import

D.Taking a manual offline portal backup and restoring to a new account

AnswerA

The Change Feed processor streams inserts and updates from the source container in order, letting a separate consumer write embeddings into the target container while the application keeps reading and writing. This satisfies the stem's no-downtime migration requirement without offline export or restore.

Why this answer

The Azure Cosmos DB Change Feed processor provides an ordered, continuous stream of inserts and updates from a source container, which a consumer can read and write into a target container in near real time. This enables online migration of vector embeddings without taking the application offline, since the source container keeps serving reads and writes while the change feed replicates data. It is the canonical pattern for live container-to-container migration in Cosmos DB for NoSQL.

Exam trap

AI-200 often tests whether candidates recognize that 'without taking the application offline' rules out any backup/restore or batch ETL option and points to a streaming, native Cosmos DB mechanism — the Change Feed processor.

How to eliminate wrong answers

Option B is wrong because Azure Data Factory tumbling window triggers over Blob Storage operate on batch schedules against blob data and do not natively stream Cosmos DB container changes, making them unsuitable for a live, low-latency migration. Option C is wrong because SSIS file import is an on-premises/ETL file-based mechanism with no native Cosmos DB change-feed integration and would require offline exports. Option D is wrong because a manual offline portal backup and restore explicitly requires taking the application offline, directly violating the stated requirement.

Full explanation →

33

MCQeasy

You are using Azure Container Apps. You need to deploy a new version of your AI model without downtime. Which deployment strategy should you configure?

A.Traffic splitting between revisions.

B.Overwrite the current revision.

C.Rolling update.

D.Scale to zero and redeploy.

AnswerA

Traffic splitting routes a percentage of requests to the new revision while the old revision still serves traffic, enabling gradual rollout and rollback without downtime. This directly satisfies the no-downtime constraint, unlike single-revision or recreate strategies that briefly interrupt service.

Why this answer

Azure Container Apps supports multiple revisions and allows you to split incoming traffic between them by percentage or label. By deploying the new model as a new revision and gradually shifting traffic, you achieve zero-downtime deployment and can perform canary or blue-green releases. This is the native mechanism for safe, progressive rollout in Container Apps.

Exam trap

AI-200 often tests the assumption that Container Apps behaves like AKS with rolling updates — the trap is forgetting that Container Apps uses immutable revisions with traffic splitting, not in-place rolling updates.

How to eliminate wrong answers

Option B is wrong because overwriting the current revision causes an in-place update that can interrupt running requests and provides no rollback path. Option C is wrong because Azure Container Apps does not expose a Kubernetes-style 'rolling update' primitive; revision-based traffic splitting is the supported pattern. Option D is wrong because scaling to zero and redeploying causes downtime and cold-start latency, defeating the no-downtime requirement.

Full explanation →

34

MCQeasy

You need to ensure that your vector data in Azure AI Search is protected at rest. Which setting should you verify?

A.Configure Customer-Managed Keys (CMK) for the search service.

B.Enable TLS 1.3 on the search service.

C.Disable public network access.

D.Enable Always Encrypted on the Cosmos DB container.

AnswerA

Customer-Managed Keys in Azure AI Search encrypt indexes and vector data at rest using a key held in Azure Key Vault, satisfying the requirement for control over encryption keys. Microsoft Entra ID governs access, not encryption, so verifying CMK configuration directly addresses the at-rest protection constraint in the stem.

Why this answer

Customer-Managed Keys (CMK) in Azure AI Search provide encryption at rest for the service's data, including vector indexes, by allowing you to use your own Azure Key Vault key to encrypt the service's internal storage. This ensures that vector data is protected at rest with a key you control, meeting compliance requirements. The other options address in-transit encryption (TLS), network access, or a different service (Cosmos DB), not at-rest encryption for Azure AI Search.

Exam trap

AI-200 often tests the distinction between encryption at rest and in transit, and candidates may confuse network security settings with data encryption, leading them to choose TLS or network restrictions instead of CMK.

How to eliminate wrong answers

Option B is wrong because TLS 1.3 encrypts data in transit between clients and the search service, not data at rest. Option C is wrong because disabling public network access restricts network connectivity but does not encrypt data at rest. Option D is wrong because Always Encrypted is a feature of Azure Cosmos DB that protects data within that database, not Azure AI Search vector data.

Full explanation →

35

MCQhard

You are designing a disaster recovery strategy for an Azure Event Hubs namespace. You configure Geo-Disaster Recovery pairing between a primary region (East US) and a secondary region (West US). During a disaster drill, you trigger a failover. What happens to the DNS alias pointing to the Event Hubs namespace?

A.The primary namespace automatically becomes the replica of the secondary namespace without breaking the pair.

B.The alias is automatically updated to point to the secondary namespace, enabling client reconnection without changing connection strings.

C.The alias enters a Read-Only state for 24 hours while DNS propagation finishes globally.

D.The alias is permanently deleted and clients must be hardcoded with the secondary namespace connection string.

AnswerB

Geo-Disaster Recovery uses a namespace DNS alias rather than hard-coded endpoints. On failover, the alias is repointed to the secondary namespace automatically, so clients reconnect using unchanged connection strings, satisfying the drill's requirement for transparent failover.

Why this answer

Geo-Disaster Recovery in Azure Event Hubs uses a DNS alias (namespace hostname) that abstracts the primary and secondary namespaces. When you trigger a failover, the alias's DNS CNAME record is automatically repointed to the secondary namespace, so clients using the alias connection string reconnect without any configuration change. This is the core value of the alias-based failover model.

Exam trap

AI-200 often tests the misconception that failover requires changing connection strings or that the alias is deleted; the key is that the alias is automatically repointed so clients using the alias reconnect transparently.

How to eliminate wrong answers

Option A is wrong because after failover the primary namespace becomes the new secondary (replica) only after the pairing is re-established/break-pair is performed; the alias does not silently swap roles without breaking the pair. Option C is wrong because there is no 24-hour read-only DNS state — the alias is updated immediately upon failover, not placed in a read-only hold. Option D is wrong because the alias is never deleted; it is repointed, which is precisely why clients do not need to hardcode the secondary connection string.

Full explanation →

36

MCQmedium

You have an Azure Container Registry and an Azure Kubernetes Service cluster in different Azure regions. You want to ensure that AKS nodes pull container images from a local regional endpoint to minimize latency and cross-region data transfer fees. What feature should you configure on ACR?

A.Azure ExpressRoute global reach

B.ACR Import command scheduled daily

C.ACR Geo-Replication

D.Azure Traffic Manager DNS routing

AnswerC

ACR geo-replication creates regional replicas of the registry, so AKS nodes pull images from a local endpoint in their own region. This directly satisfies the stem's latency and cross-region data transfer constraints, unlike a single-region registry or CDN caching, which do not provide a writable local registry endpoint.

Why this answer

ACR Geo-Replication lets you replicate a registry to multiple Azure regions so that each AKS cluster pulls from a regional replica endpoint, reducing latency and eliminating cross-region egress charges. When geo-replication is enabled, ACR automatically routes pull requests to the closest replica based on the client's region. This is the native, supported way to achieve regional image locality.

Exam trap

AI-200 often tests whether candidates confuse image replication with network optimization, so the trap is choosing ExpressRoute or Traffic Manager because they sound like latency-reduction tools when the requirement is specifically a regional registry endpoint.

How to eliminate wrong answers

Option A is wrong because ExpressRoute Global Reach connects on-premises networks through Microsoft's backbone; it does not create regional ACR endpoints and is irrelevant to image pull latency between Azure regions. Option B is wrong because a scheduled ACR Import is a one-way copy operation that duplicates images but does not provide a managed regional endpoint or automatic routing, and it introduces staleness between imports. Option D is wrong because Traffic Manager is a DNS-based global load balancer for arbitrary endpoints; it does not integrate with ACR's registry endpoint model and cannot route to a registry replica.

Full explanation →

37

MCQmedium

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

A.Enable a system-assigned managed identity on App Service and assign the Search Index Data Reader role on Azure AI Search

B.Configure an IP firewall on Azure AI Search to allow only the static outbound IP of App Service

C.Store the primary admin API key in Azure App Service configuration environment variables

D.Use shared access signatures (SAS) tokens generated by a client script

AnswerA

A system-assigned managed identity lets App Service obtain Microsoft Entra ID tokens automatically, so no API keys sit in configuration files. Assigning the Search Index Data Reader role on Azure AI Search grants least-privilege query access, satisfying the requirement to query indices without embedded credentials.

Why this answer

The most secure approach is to enable a system-assigned managed identity on the App Service and grant it the Search Index Data Reader role on the Azure AI Search service. Managed identities eliminate secrets entirely — Azure AD issues and rotates the credentials automatically, and the app authenticates to Search using its identity. This follows the zero-trust, secretless best practice for service-to-service authentication.

Exam trap

AI-200 often tests whether candidates equate network restrictions with authentication; the trap is choosing the IP firewall because it sounds secure, when the question explicitly asks for a secretless authentication mechanism.

How to eliminate wrong answers

Option B is wrong because an IP firewall only restricts network origin; it does not authenticate the caller, and it does nothing to remove the need for an API key — anyone from that IP could still query if they had a key. Option C is wrong because storing the primary admin API key in App Service configuration embeds a long-lived secret that can leak via logs, source control, or portal access, and the admin key grants full control rather than least-privilege read access. Option D is wrong because Azure AI Search does not issue SAS tokens — SAS is an Azure Storage concept — so this option describes a mechanism that does not exist for Search.

Full explanation →

38

Multi-Selectmedium

When configuring vector search in Azure AI Search, which TWO components are required to successfully define and execute a vector search query? (Choose two)

Select 2 answers

A.A Cosmos DB container partition key

B.An Azure SQL Server database connection string

C.A vector query payload specifying the query vector and target field

D.A vector field defined in the index schema

E.An HDInsight Hadoop cluster endpoint

AnswersC, D

The query payload carries the query vector and names the target vector field, which the search service needs to compute similarity against indexed vectors. This satisfies the stem's requirement by supplying the input and field reference that execute the vector search.

Why this answer

Option D is correct because Azure AI Search requires the index schema to include a vector field (created with the Collection(Edm.Single) data type and a dimensions value) before any vector search can be performed against it; without a defined vector field there is nothing to query. Option C is correct because executing a vector search requires a query payload that supplies the query vector (for example, "vectorQueries" with "kind": "vector", "vector": [...], and "fields": "<vectorFieldName>") along with the target vector field, which the search engine uses to compute similarity. Options A, B, and E are incorrect because a Cosmos DB partition key, an Azure SQL connection string, and an HDInsight Hadoop endpoint are unrelated to Azure AI Search vector query definition and execution; vector search relies on the search index schema and query payload, not on those external data-store or big-data components.

Exam trap

AI-200 often tests whether candidates conflate indexer prerequisites (data source connection strings) with query-time prerequisites — the trap is picking a database connection string when the question is about executing a vector query, not ingesting data.

Full explanation →

39

Multi-Selectmedium

When designing an Azure AI Search index schema, which TWO properties must be defined for every field in the index? (Choose two)

Select 2 answers

A.analyzerName

B.name

C.scoringProfile

D.vectorDimensions

E.type

AnswersB, E

Every field in an Azure AI Search index requires a name, which uniquely identifies it within the schema and is used in queries, filters, and scoring profiles. It is mandatory alongside type; attributes such as searchable, filterable, and retrievable are optional.

Why this answer

Option B (name) is correct because every field in an Azure AI Search index schema requires a unique name that identifies the field within the fields collection, and this name is used in queries, filters, and result documents. Option E (type) is correct because each field must declare an Edm data type (such as Edm.String, Edm.Int32, Edm.Boolean, Edm.DateTimeOffset, or Collection(Edm.String)) so the search engine knows how to index, store, and query the field's values. Option A (analyzerName) is not required for every field; analyzers apply only to searchable string fields and default to the standard Lucene analyzer when omitted.

Option C (scoringProfile) is not a field-level property at all; scoring profiles are defined at the index level to influence relevance ranking. Option D (vectorDimensions) is only required for fields of type Collection(Edm.Single) that participate in vector search, not for every field.

Exam trap

AI-200 often tests whether candidates confuse optional field attributes (analyzer, scoring profile, dimensions) with the two truly mandatory properties — name and type — which must be present on every field regardless of its role.

Full explanation →

40

MCQeasy

When designing an Azure AI Search solution, you need to store high-dimensional embeddings. Which field type must be used to store these vector representations correctly?

A.Edm.Double

B.Collection(Edm.Single)

C.Edm.String

D.Collection(Edm.Int32)

AnswerB

Collection(Edm.Single) stores a single-precision float array, which is precisely the vector format Azure AI Search requires for high-dimensional embeddings. It satisfies the stem's constraint that embeddings be stored correctly, since Edm.Single maps to 32-bit floats and the Collection wrapper holds the multiple dimensions each embedding needs.

Why this answer

Azure AI Search stores vector embeddings in fields of type Collection(Edm.Single), which is a collection of single-precision floats. This matches the float32 output of models like text-embedding-ada-002 and is the required type for vector fields. The field must also have a vector search profile and dimensions defined.

Exam trap

AI-200 often tests whether candidates remember the exact EDM type for vectors; many pick Edm.Double or Edm.String by analogy with other data types, missing that Collection(Edm.Single) is required.

How to eliminate wrong answers

Option A is wrong because Edm.Double is a scalar double, not a collection, and Azure AI Search vector fields require a collection type; also double precision is not the supported vector type. Option C is wrong because Edm.String is for text and cannot store numeric vector arrays for vector search. Option D is wrong because Collection(Edm.Int32) stores integers, but embeddings are floating-point values; using int32 would lose precision and is not the supported vector type.

Full explanation →

41

MCQeasy

An AI pipeline uses Azure Service Bus Queues. You want to inspect the number of messages currently residing in a queue waiting to be processed without actually receiving or locking them. Which Azure Portal section or metric should you check?

A.The Azure Storage Account queued message monitoring graphs.

B.The Event Grid subscription delivery status log.

C.The Event Hubs capture storage container file list.

D.The Service Bus Queue 'Overview' blade displaying Active Message Count metrics.

AnswerD

The Overview blade's Active Message Count metric reports messages available for delivery without receiving or locking them, satisfying the requirement to inspect queue depth non-destructively. Unlike peek-lock operations, which alter lock state, this metric is purely observational, giving the current waiting-message count directly.

Why this answer

The Service Bus Queue 'Overview' blade in the Azure Portal displays the Active Message Count metric, which reports the number of messages currently in the queue that are ready to be received. This is a non-destructive metric — it does not lock or receive messages — and is the standard way to inspect queue depth.

Exam trap

AI-200 often tests whether candidates can distinguish Service Bus queue metrics from Storage Queue, Event Grid, and Event Hubs telemetry, causing them to pick a monitoring surface for the wrong service.

How to eliminate wrong answers

Option A is wrong because Azure Storage Account queued message monitoring applies to Storage Queues, not Service Bus Queues, and is a different service entirely. Option B is wrong because Event Grid subscription delivery status logs track event delivery attempts, not Service Bus queue depth. Option C is wrong because Event Hubs Capture storage containers hold archived Event Hubs data, which has no relationship to Service Bus queue message counts.

Full explanation →

42

MCQhard

You need to configure network security for an Azure Container Apps environment that hosts an internal AI scoring API. The API must only be reachable from a specific Azure Virtual Network (VNet) and blocked from public internet access. How should you configure the environment?

A.Attach a Private Endpoint to the Azure Container Registry hosting the app

B.Enable IP security restrictions on the default public ingress

C.Deploy the Container Apps environment with an internal Virtual Network integration and internal load balancer

D.Configure an Azure Front Door instance with WAF rules in front of the public endpoint

AnswerC

Internal VNet integration with an internal load balancer gives the Container Apps environment a private IP address only, so the scoring API is reachable solely from within the specified Azure Virtual Network. This satisfies the stem's requirement to block public internet access while permitting VNet-only connectivity.

Why this answer

To make a Container Apps environment reachable only from a specific VNet and block public internet access, you deploy the environment with VNet integration and configure it to use an internal load balancer. This gives the environment a private IP in your subnet and removes the public ingress endpoint entirely.

Exam trap

AI-200 often tests whether candidates confuse securing the container registry (image supply chain) with securing the running app's network ingress — candidates pick Private Endpoint on ACR thinking it isolates the API, when it only isolates image pulls.

How to eliminate wrong answers

Option A is wrong because a Private Endpoint on Azure Container Registry only secures image pulls from the registry — it does nothing to control inbound access to the running Container App. Option B is wrong because IP security restrictions on public ingress still expose a public endpoint and only filter by source IP; they do not make the app VNet-only and are weaker than true private networking. Option D is wrong because Azure Front Door with WAF sits in front of a public endpoint and is designed for internet-facing traffic — it does not restrict access to a specific VNet and actually increases public exposure.

Full explanation →

43

Multi-Selectmedium

You are planning a data layer architecture for an AI application on Azure that requires both relational transactional storage and vector search capabilities. Which TWO Azure database services natively support vector data types and similarity search functions? Choose two.

Select 2 answers

A.Azure SQL Database

B.Azure Queue Storage

C.Azure Cosmos DB for NoSQL

D.Azure Table Storage

E.Azure Cache for Redis (Basic tier without modules)

AnswersA, C

Azure SQL Database supports native VECTOR data types and similarity search functions, letting the same relational engine handle transactional workloads and vector queries. This satisfies the requirement for combined relational transactional storage and vector search without a separate dedicated vector store.

Why this answer

Azure SQL Database (A) is correct because it natively supports a VECTOR data type and vector similarity functions such as VECTOR_DISTANCE, enabling cosine and Euclidean similarity search directly in T-SQL alongside relational transactional workloads. Azure Cosmos DB for NoSQL (C) is correct because it provides native vector indexing and vector search (including DiskANN-based indexing) with similarity functions like VectorDistance, so it can store and query embeddings alongside JSON documents. Azure Queue Storage (B) is a simple message-queue service with no data types or query engine, so it cannot store vectors or perform similarity search.

Azure Table Storage (D) is a key-value/NoSQL table store without vector data types or similarity functions. Azure Cache for Redis Basic tier (E) lacks the RediSearch/vector modules, so it cannot perform vector similarity search in that tier.

Exam trap

AI-200 often tests the misconception that any Azure storage service supports vectors, when only specific databases like Azure SQL Database and Cosmos DB for NoSQL have native vector capabilities.

Full explanation →

44

MCQeasy

You need to deploy a containerized AI model to Azure Container Apps and configure it to scale based on Azure Service Bus queue messages. Which scaler should you specify?

A.azure-blob

B.azure-service-bus

C.memory

D.cron

AnswerB

The azure-service-bus scaler reads queue or topic message counts via KEDA and drives replica count accordingly. Azure Container Apps requires this exact scaler name, so it satisfies the queue-length scaling requirement rather than CPU or HTTP concurrency triggers.

Why this answer

Azure Container Apps uses KEDA-based scaling, and the azure-service-bus scaler is the built-in KEDA scaler designed to read Service Bus queue or topic subscription message counts and scale replicas accordingly. Specifying azure-service-bus as the scale rule type with the queue name and connection metadata lets Container Apps scale in/out based on message backlog. This directly matches the requirement to scale on Service Bus queue messages.

Exam trap

AI-200 often tests whether candidates confuse KEDA scaler types, so the trap is picking a resource scaler (memory/CPU) or a generic trigger (cron) when the question explicitly names an external event source like Service Bus.

How to eliminate wrong answers

Option A is wrong because azure-blob scales on Azure Blob Storage events or queue length for blob-triggered workloads, not Service Bus queues. Option C is wrong because memory is a resource-utilization scaler that reacts to container memory consumption, not external message queue depth. Option D is wrong because cron is a time-based schedule scaler that scales on a fixed timetable, not on Service Bus message volume.

Full explanation →

45

Multi-Selecthard

You are designing a secure data layer architecture for financial documents using Azure Cosmos DB for NoSQL and Azure AI Search. Which THREE compliance and security controls should you implement? (Choose three)

Select 3 answers

A.Store all database backup files in unencrypted public blob storage containers

B.Enable diagnostic logging and audit log streaming to Azure Monitor / Log Analytics

C.Disable authentication keys and allow anonymous public access for easy integration

D.Configure Customer-Managed Keys (CMK) using Azure Key Vault for data at rest encryption

E.Restrict network access using Virtual Network service endpoints and private link

AnswersB, D, E

Diagnostic logging and audit log streaming to Azure Monitor or Log Analytics capture control-plane and data-plane operations, providing the audit trail and monitoring evidence required for financial compliance. This satisfies the stem's compliance and security control requirement by making database activity traceable and alertable.

Why this answer

Option B is correct because enabling diagnostic logging and streaming audit logs to Azure Monitor / Log Analytics provides the tamper-evident activity trail and monitoring required for regulatory compliance (e.g., PCI DSS, SOX) on financial document workloads. Option D is correct because configuring Customer-Managed Keys (CMK) via Azure Key Vault gives the organization control over the encryption keys protecting data at rest in Cosmos DB, satisfying requirements for key ownership, rotation, and revocation that Microsoft-managed keys do not meet. Option E is correct because restricting network access with Virtual Network service endpoints and Azure Private Link removes public internet exposure, ensuring only approved private endpoints within the VNet can reach the Cosmos DB and Azure AI Search resources.

Option A is wrong because storing backups in unencrypted public blob containers directly violates encryption-at-rest and access-control mandates. Option C is wrong because disabling authentication keys and allowing anonymous public access eliminates authentication and authorization, which is unacceptable for sensitive financial data.

Exam trap

AI-200 often tests whether candidates recognize that compliance requires encryption, logging, and network isolation together, while distractors offer convenience features (anonymous access, public backups) that are actually severe security violations.

Full explanation →

46

MCQeasy

Which Azure AI Search metric or tool helps administrators monitor query volume, latency, and throttling rates across search units?

A.Azure Monitor metrics and diagnostic logs

B.App Service stream logs

C.Azure Storage Explorer

D.Cosmos DB Data Explorer

AnswerA

Azure Monitor metrics expose query volume, latency, and throttling counters per search service and search unit, while diagnostic logs capture detailed operation records. Together they satisfy the stem's monitoring requirement, unlike index statistics or relevance scores, which describe content rather than service health.

Why this answer

Azure Monitor metrics and diagnostic logs are the native observability tools for Azure AI Search, exposing query volume (SearchQueriesPerSecond), latency (SearchLatency), and throttling (ThrottledSearchQueriesPercentage) broken down by search unit. Diagnostic logs can be routed to Log Analytics, Event Hubs, or Storage for deeper analysis of query and indexing operations. These are the only options that directly instrument the search service itself.

Exam trap

AI-200 often tests whether candidates confuse monitoring tools for the search service with monitoring tools for adjacent services (App Service, Storage, Cosmos DB), so pick the option that names Azure Monitor metrics and diagnostic logs explicitly.

How to eliminate wrong answers

Option B is wrong because App Service stream logs only capture logs from Azure App Service web apps and have no visibility into Azure AI Search service internals. Option C is wrong because Azure Storage Explorer is a GUI client for managing blob, file, queue, and table storage — it does not monitor search service metrics. Option D is wrong because Cosmos DB Data Explorer is a query and data-management tool for Cosmos DB containers and provides no telemetry on Azure AI Search query volume, latency, or throttling.

Full explanation →

47

Multi-Selectmedium

You are configuring vector search in Azure AI Search for a knowledge mining solution. You need to ensure that the vector search queries return results efficiently and accurately. Which TWO components must be defined in the index schema? (Choose two.)

Select 2 answers

A.A suggester for autocomplete functionality.

B.A scoring profile to boost certain fields.

C.A vector search profile that specifies the algorithm and parameters.

D.A semantic configuration for ranking results.

E.A vector field with dimensions matching the embedding model.

AnswersC, E

A vector search profile defines the algorithm (e.g., HNSW) and its parameters, as well as the similarity metric. It is referenced by the vector field and determines how vector search is executed. Without a profile, the vector field cannot be properly configured for search. This is a required component for vector search in Azure AI Search.

Why this answer

To enable vector search in Azure AI Search, the index must include a vector field that stores the embeddings with the correct dimensions, and a vector search profile that defines the algorithm and parameters. These two components are essential for indexing vectors and executing similarity queries. Other features like semantic ranking or suggesters are optional and not required for basic vector search.

Exam trap

The trap here is confusing optional enhancements like semantic ranking with the core requirements for vector search, which are the vector field and the vector search profile.

Full explanation →

48

MCQeasy

An application publishes custom events to an Azure Event Grid topic. You want to inspect the dead-lettered events that failed delivery after the maximum retry period. Where must you configure the dead-letter destination?

A.Azure SQL Database table

B.Local App Service temporary file system

C.Azure Blob Storage container

D.Azure Service Bus Dead-Letter Queue

AnswerC

Dead-lettering in Azure Event Grid requires a blob storage container as the destination, configured on the event subscription. Event Grid writes failed events there after exhausting retries, satisfying the requirement to inspect undelivered custom events. No other service supports this dead-letter target.

Why this answer

Event Grid dead-lettering requires an Azure Blob Storage container as the destination, configured on the event subscription. When an event fails all delivery retries (default 30 attempts over 24 hours), it is written to that container as a blob so you can inspect and reprocess it. Blob Storage is the only supported dead-letter target for Event Grid.

Exam trap

The trap here is confusing Event Grid dead-lettering (Blob Storage only) with Service Bus dead-letter queues, which are a completely separate mechanism tied to Service Bus messaging.

How to eliminate wrong answers

Option A is wrong because Event Grid cannot write dead-lettered events directly to an Azure SQL Database table — there is no native SQL sink for dead-lettering. Option B is wrong because the App Service local file system is ephemeral, not durable, and not an Event Grid-supported destination. Option D is wrong because Service Bus DLQs apply to Service Bus messages that fail processing within a Service Bus queue/topic subscription, not to Event Grid delivery failures — the two dead-letter concepts are unrelated.

Full explanation →

49

MCQeasy

You need to check the health status of Azure AI services globally and see if any regional outages are currently impacting your deployed models. Which Azure tool should you consult?

A.Azure Cost Management

B.Azure Policy

C.Azure Advisor

D.Azure Service Health

AnswerD

Azure Service Health reports platform-wide and regional service issues, including outages affecting Azure AI services, filtered to your subscriptions and resources. This satisfies the need to check global health and current regional outages impacting deployed models.

Why this answer

Azure Service Health provides personalized and global views of Azure service issues, planned maintenance, health advisories, and security advisories that may affect your deployed resources. It is the correct tool to check for regional outages impacting Azure AI services and your models.

Exam trap

AI-200 often tests whether candidates confuse Azure Advisor (recommendations) with Azure Service Health (live outage/incident reporting) — the trap is picking Advisor because it sounds like it 'advises on health.'

How to eliminate wrong answers

Option A is wrong because Azure Cost Management tracks and analyzes spending, not service health or outages. Option B is wrong because Azure Policy enforces governance rules and compliance on resources, not health monitoring. Option C is wrong because Azure Advisor provides best-practice recommendations for cost, performance, reliability, and security — it does not report live regional outages.

Full explanation →

50

Multi-Selecthard

You are optimizing an enterprise AI architecture for cost and performance. Which THREE of the following strategies effectively reduce Azure AI and infrastructure spending without sacrificing reliability? (Choose three)

Select 3 answers

A.Delete all Application Insights workspaces and stop collecting any monitoring telemetry.

B.Purchase Azure reservations or provisioned throughput commitments for steady-state workloads.

C.Right-size virtual machine and GPU SKUs based on historical Azure Monitor utilization metrics.

D.Configure Azure Machine Learning compute clusters to scale down to zero nodes when idle.

E.Run all development and production workloads on the highest tier enterprise GPUs 24/7 regardless of usage.

AnswersB, C, D

Reservations and provisioned throughput convert variable, consumption-based billing into a discounted fixed rate for predictable, steady-state demand, cutting compute and token costs substantially. Because the stem requires no loss of reliability, this preserves dedicated capacity rather than trading performance away, unlike spot or serverless alternatives.

Why this answer

Option B is correct because Azure reservations and provisioned throughput commitments (for example, Azure OpenAI Provisioned Throughput Units or Azure AI Search provisioned capacity) offer significant discounts over pay-as-you-go pricing for predictable, steady-state workloads, lowering cost while maintaining guaranteed capacity and reliability. Option C is correct because right-sizing VM and GPU SKUs using historical Azure Monitor utilization metrics ensures you pay only for the compute capacity actually needed, eliminating over-provisioning waste without reducing the performance required by the workload. Option D is correct because Azure Machine Learning compute clusters support min_nodes=0, which automatically scales the cluster down to zero nodes when idle, so you incur no compute charges during idle periods while still scaling back up on demand, preserving availability.

Option A is incorrect because deleting Application Insights workspaces and halting telemetry removes observability, degrading reliability, troubleshooting, and performance tuning rather than reducing spend responsibly. Option E is incorrect because running all development and production workloads on the highest-tier enterprise GPUs 24/7 regardless of usage maximizes cost and wastes capacity, directly contradicting the goal of cost optimization.

Exam trap

AI-200 often tests whether candidates equate 'cost reduction' with 'removing monitoring' or 'always using top-tier hardware', when the correct strategies are commitment discounts, right-sizing, and scale-to-zero.

Full explanation →

51

MCQmedium

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

A.Public IP addresses assigned to all developer workstations with NSG allow rules

B.Azure ExpressRoute or Site-to-Site VPN with Azure Private Link to workspace private endpoints

C.Turning off all network security groups and opening all ports on the Azure firewall

D.Azure Bastion deployed on the on-premises physical router

AnswerB

ExpressRoute or Site-to-Site VPN extends the corporate network to Azure, while Azure Private Link routes workspace traffic through private endpoints, keeping management ports off the public internet. This satisfies the on-premises access requirement without exposing the workspace publicly, unlike public endpoint access or jump-host workarounds.

Why this answer

To reach a private-endpoint-secured Azure Machine Learning workspace from on-premises without exposing management ports, you combine private connectivity with Azure Private Link. ExpressRoute or a Site-to-Site VPN provides the encrypted hybrid path from the corporate network into Azure, and Private Link resolves the workspace's private endpoint to a private IP inside the VNet, so notebook and compute traffic never traverses the public internet.

Exam trap

AI-200 often tests the misconception that public IPs plus NSG rules constitute secure hybrid access, when the correct answer requires private connectivity (ExpressRoute/VPN) plus Private Link to avoid internet exposure.

How to eliminate wrong answers

Option A is wrong because assigning public IPs to developer workstations and allowing NSG rules exposes the workspace to the internet and defeats the purpose of private endpoints — it reintroduces the public attack surface. Option C is wrong because disabling NSGs and opening all ports is a severe security anti-pattern that removes defense in depth and violates least privilege. Option D is wrong because Azure Bastion is an Azure-hosted jump-host service for RDP/SSH into Azure VMs; it cannot be deployed on an on-premises physical router and does not provide hybrid private connectivity to a workspace.

Full explanation →

52

MCQmedium

You are configuring an Azure AI Search index where text fields are automatically analyzed using language-specific rules. Which property on an Edm.String field specifies the language analyzer (e.g., 'en.microsoft')?

A.tokenizerType

B.languageMapping

C.vectorProfile

D.analyzer

AnswerD

The analyzer property on an Edm.String field names the language analyzer applied at indexing and query time, such as en.microsoft for English linguistic rules. It governs tokenisation, stemming and stop-word handling for that specific field.

Why this answer

In Azure AI Search, the 'analyzer' property on an Edm.String field specifies the language analyzer (e.g., 'en.microsoft', 'fr.lucene') that governs tokenization, stemming, and stop-word removal for that field. Setting it per-field enables language-specific text processing so queries match documents correctly across languages.

Exam trap

AI-200 often tests whether candidates confuse field-level analyzer configuration with tokenizer or vector profile settings, so distractors use plausible-sounding but non-existent property names.

How to eliminate wrong answers

Option A is wrong because tokenizerType is not a field-level property in Azure AI Search; tokenization is configured inside a custom analyzer definition, not directly on the field. Option B is wrong because languageMapping is not a valid Azure AI Search field property — it is a fabricated name. Option C is wrong because vectorProfile is used in vector search configurations to define HNSW/algorithm parameters, not text analyzers.

Full explanation →

53

MCQmedium

You are managing an Azure Kubernetes Service (AKS) cluster that runs high-throughput AI model training jobs using NVIDIA Tensor Core GPUs. Pods frequently fail to schedule because of insufficient GPU memory across existing nodes. You need to ensure the cluster automatically provisions new GPU-enabled worker nodes when resource demands increase. What should you configure?

A.Configure KEDA (Kubernetes Event-driven Autoscaling) with a Prometheus scaler.

B.Configure the Horizontal Pod Autoscaler (HPA) with custom GPU metrics.

C.Enable the Kubernetes Cluster Autoscaler on a node pool containing GPU virtual machine sizes.

D.Deploy the Azure Container Storage operator with GPU caching enabled.

AnswerC

The Cluster Autoscaler watches for unschedulable pods and scales the GPU node pool out, provisioning new GPU virtual machine nodes when capacity is insufficient. This directly resolves pending training pods caused by exhausted GPU memory across existing nodes.

Why this answer

The Kubernetes Cluster Autoscaler watches for pods that cannot be scheduled due to insufficient resources and automatically scales the node pool up or down. When configured on a node pool that contains GPU-enabled VM sizes (such as NC or ND series), it will provision additional GPU nodes when training pods are pending due to GPU memory constraints. This is the only option that adds new worker nodes rather than scaling existing pods or reacting to events.

Exam trap

AI-200 often tests the confusion between pod-level autoscaling (HPA/KEDA) and node-level autoscaling (Cluster Autoscaler) — candidates pick HPA or KEDA thinking it will 'add capacity,' but only the Cluster Autoscaler provisions new nodes.

How to eliminate wrong answers

Option A is wrong because KEDA scales workloads (pods/deployments) based on event sources like Prometheus metrics — it does not provision new nodes, so pending pods would remain unschedulable. Option B is wrong because HPA scales the number of pod replicas based on metrics, but if no node has free GPU capacity, additional replicas simply stay Pending. Option D is wrong because Azure Container Storage provides persistent storage and caching for containers; it has nothing to do with node provisioning or GPU scheduling.

Full explanation →

54

MCQhard

You are configuring vector search on an Azure AI Search index using a custom vectorizer that points to an external embedding endpoint. Which authentication method is recommended and natively supported for securely connecting Azure AI Search to the Azure OpenAI endpoint?

A.Managed Identity (system-assigned or user-assigned)

B.OAuth2 client credentials grant with Azure AD tenant federation

C.Shared Access Signature (SAS) tokens

D.Basic authentication with API keys stored in index metadata

AnswerA

Managed Identity lets Azure AI Search obtain Microsoft Entra ID tokens for the Azure OpenAI endpoint without storing secrets, and the custom vectorizer natively supports this credential. It satisfies the secure connection constraint while avoiding key rotation overhead.

Why this answer

Managed Identity is the recommended and natively supported authentication method for Azure AI Search to securely connect to Azure OpenAI when using a custom vectorizer. It leverages Azure AD to provide an identity for the search service, eliminating the need to manage credentials. The identity is automatically managed by Azure and can be granted permissions to the Azure OpenAI resource, ensuring secure access without storing secrets.

Exam trap

AI-200 often tests the misconception that any OAuth2 flow or API key is acceptable for service-to-service authentication, but the exam expects knowledge that managed identity is the natively supported and recommended method for Azure AI Search to Azure OpenAI connections.

How to eliminate wrong answers

Option B is wrong because OAuth2 client credentials grant with Azure AD tenant federation is not natively supported by Azure AI Search for connecting to Azure OpenAI; it requires manual token acquisition and management, which is not integrated into the vectorizer configuration. Option C is wrong because Shared Access Signature (SAS) tokens are used for delegated access to Azure Storage, not for authenticating to Azure OpenAI endpoints. Option D is wrong because basic authentication with API keys stored in index metadata is insecure and not recommended; API keys are static secrets that can be leaked, and Azure AI Search does not support storing them in index metadata for vectorizer authentication.

Full explanation →

55

Multi-Selectmedium

You are troubleshooting an AI application container in an AKS cluster that cannot resolve external domain names (e.g., huggingface.co). Which TWO Kubernetes components should you investigate?

Select 2 answers

A.kube-dns service endpoint mapping

B.Horizontal Pod Autoscaler configuration

C.Persistent Volume Claim binding state

D.Ingress controller SSL certificate expiration

E.CoreDNS deployment and pod health in the kube-system namespace

AnswersA, E

The kube-dns service must map to healthy CoreDNS pod endpoints; if the endpoint list is empty or points to terminated pods, name resolution fails cluster-wide. Checking the service's endpoint mapping confirms traffic reaches a live resolver.

Why this answer

Option A (kube-dns service endpoint mapping) is correct because in AKS the kube-dns Service in kube-system is the ClusterIP endpoint that pods use for DNS queries; if its selector does not match the CoreDNS pods, the endpoint list is empty and name resolution fails. Option E (CoreDNS deployment and pod health in the kube-system namespace) is correct because CoreDNS pods actually serve DNS; if they are crashlooping, unready, or scaled to zero, external names like huggingface.co cannot be resolved. Option B is irrelevant because the Horizontal Pod Autoscaler only adjusts replica counts based on metrics and has no role in DNS resolution.

Option C is irrelevant because PVC binding affects storage mounting, not name resolution. Option D is irrelevant because an expired Ingress TLS certificate only breaks HTTPS trust for inbound traffic, not outbound DNS lookups from the container.

Exam trap

AI-200 often tests whether candidates can distinguish DNS-layer failures from other pod failures, so the trap is selecting storage or autoscaling components because they are common AKS troubleshooting topics, even though the symptom is specifically name resolution.

Full explanation →

56

Multi-Selectmedium

You are troubleshooting event delivery failures in Azure Event Grid. Which TWO mechanisms can help you analyze or recover undeliverable events? (Choose two)

Select 2 answers

A.Configuring a Dead-Letter destination pointing to an Azure Blob Storage container

B.Enabling Service Bus message session locks on the event subscription

C.Viewing delivery metrics and logs via Azure Monitor diagnostic settings

D.Running the az servicebus queue purge command

E.Using Event Hubs Capture to replay webhook HTTP headers

AnswersA, C

Dead-lettering redirects events that Event Grid cannot deliver after retries to a Blob Storage container, preserving the original payload and failure metadata. This directly satisfies the troubleshooting requirement to analyse and recover undeliverable events rather than losing them silently.

Why this answer

Option A is correct because Azure Event Grid supports a dead-letter destination (typically an Azure Blob Storage container) where events that cannot be delivered after all retry attempts are stored, allowing you to inspect and later reprocess the undeliverable events. Option C is correct because enabling Azure Monitor diagnostic settings on the Event Grid topic or subscription lets you route delivery and publish metrics plus resource logs (e.g., DeliveryFailures, DroppedEvents) to Log Analytics, Storage, or Event Hubs, which is the standard way to analyze delivery failures. Option B is not applicable because Service Bus session locks are a Service Bus feature for ordered, session-aware message consumption, not an Event Grid delivery-recovery mechanism.

Option D is wrong because 'az servicebus queue purge' deletes messages from a Service Bus queue and has nothing to do with Event Grid undeliverable events. Option E is wrong because Event Hubs Capture writes event data to storage in Avro format and does not replay webhook HTTP headers for Event Grid.

Exam trap

AI-200 often tests whether candidates confuse Event Grid with Service Bus or Event Hubs; the trap is selecting Service Bus or Event Hubs features (session locks, queue purge, Capture) that sound related but do not apply to Event Grid delivery failures.

Full explanation →

57

MCQmedium

You are building an AI-powered order processing system. A web app publishes order events to an Azure Event Grid custom topic. A downstream Azure Function must process each event and, if processing fails, the event should be retried automatically by Event Grid. You configure the event subscription with a dead-letter destination. After a few days, you notice that some events were not processed successfully and were not delivered to the dead-letter destination. You need to ensure that failed events are captured for later analysis. What should you do?

A.Verify that the dead-letter destination (a storage account container) exists and that the managed identity has the necessary permissions.

B.Change the event subscription endpoint type from Azure Function to Webhook.

C.Increase the event subscription's retry policy maximum delivery attempts.

D.Enable the 'Always deliver' option on the event subscription.

AnswerA

For Event Grid to dead-letter events, the dead-letter destination must be correctly configured and accessible. If the storage account container does not exist or the managed identity lacks the Storage Blob Data Contributor role, Event Grid cannot write the dead-lettered events. This is a common misconfiguration. Ensuring the destination exists and permissions are granted will allow failed events to be captured.

Why this answer

Event Grid dead-letters an event only after all retry attempts are exhausted and if the dead-letter destination is properly configured. The most common reason for events not appearing in dead-letter storage is that the storage container does not exist or the managed identity used by the event subscription lacks write permissions. Verifying these settings ensures that failed events are captured for later analysis.

Exam trap

The trap here is assuming that enabling dead-lettering automatically works without verifying the destination's existence and permissions.

Full explanation →

58

MCQhard

You are designing a high-scale event ingestion pipeline using Azure Event Hubs in a secure enterprise environment. Public internet access must be disabled entirely. Producers and consumers reside in a peered Virtual Network (VNet). How should you configure network connectivity to the Event Hubs namespace?

A.Enable Service Bus Relay hybrid connections across the VNet gateway.

B.Configure Private Endpoints for the Event Hubs namespace and disable public network access.

C.Deploy an Azure Bastion host in the subnet connected to the Event Hubs SAS key manager.

D.Configure IP firewall rules to allow the default gateway IP of the VNet.

AnswerB

A private endpoint creates a private IP address for the namespace inside your peered VNet via Azure Private Link, so producers and consumers reach Event Hubs over the Microsoft backbone. Disabling public network access then blocks all internet ingress, satisfying the no-public-access constraint.

Why this answer

Azure Private Endpoints create a private IP address for the Event Hubs namespace inside your VNet via Azure Private Link, and disabling public network access ensures all traffic flows over the Microsoft backbone rather than the internet. This is the canonical pattern for fully private, enterprise-grade Event Hubs connectivity from peered VNets.

Exam trap

AI-200 often tests the misconception that IP firewall rules or Bastion provide private connectivity, when only Private Endpoints with public access disabled achieve true network isolation for Event Hubs.

How to eliminate wrong answers

Option A is wrong because Service Bus Relay hybrid connections are a separate service for on-premises-to-cloud bridging and do not provide private IP connectivity to Event Hubs namespaces. Option C is wrong because Azure Bastion is a jump-host service for RDP/SSH access to VMs — it has no role in Event Hubs network connectivity and cannot interact with SAS key management. Option D is wrong because IP firewall rules still expose the namespace to the public internet (they just restrict source IPs), and the VNet's default gateway IP is not a valid producer identity for Event Hubs.

Full explanation →

59

MCQmedium

You are deploying a containerized AI application to Azure Container Instances (ACI). The application needs to pull the container image from a private Azure Container Registry (ACR). You want to authenticate ACI to ACR without embedding credentials in the deployment configuration. What should you do?

A.Store the ACR credentials in Azure Key Vault and reference them in the ACI deployment using a secret volume.

B.Use the ACR admin account username and password in the ACI deployment YAML.

C.Enable the ACI system-assigned managed identity and grant it the AcrPull role on the ACR.

D.Configure ACI to use a public container image instead, avoiding the need for authentication.

AnswerC

Azure Container Instances supports system-assigned managed identities. By enabling a managed identity on the container group and assigning it the AcrPull role on the Azure Container Registry, ACI can authenticate to ACR without storing credentials. This is a secure, recommended approach for accessing private registries.

Why this answer

To authenticate ACI to ACR without embedding credentials, you should use a managed identity. Enabling a system-assigned managed identity on the container group and granting it the AcrPull role on the ACR allows ACI to pull images securely. This eliminates the need to store credentials in the deployment configuration and follows the principle of least privilege.

Exam trap

The trap here is assuming that storing credentials in Key Vault or using admin accounts is acceptable, when managed identities provide a more secure and native authentication method.

Full explanation →

60

MCQeasy

Your organization uses Azure Event Grid namespaces for MQTT client messaging in an industrial IoT scenario. Which authentication method should you configure for IoT devices connecting directly to the Event Grid namespace MQTT broker?

A.SQL Database connection strings

B.Anonymous access with IP restriction headers

C.OAuth 2.0 client credentials grant via Service Bus endpoints

D.X.509 client certificates

AnswerD

X.509 client certificates let each IoT device authenticate to the Event Grid namespace MQTT broker using a unique cryptographic identity, satisfying the industrial requirement for direct, credential-free device connections without shared secrets or SAS tokens.

Why this answer

Azure Event Grid namespaces support MQTT v3.1.1 and v5.0, and for direct device connections the recommended and supported authentication method is X.509 client certificates. Devices present a client certificate during the TLS handshake, and Event Grid validates it against a trusted CA or thumbprint. This is the standard for IoT device authentication in Event Grid MQTT broker.

Exam trap

AI-200 often tests whether candidates confuse Event Grid MQTT authentication with Event Hubs or Service Bus authentication, so picking OAuth or SAS-based options instead of X.509 client certificates is the common error.

How to eliminate wrong answers

Option A is wrong because SQL Database connection strings are for database access, not MQTT broker authentication. Option B is wrong because anonymous access with IP restriction headers is not a supported authentication method for Event Grid MQTT and would be insecure. Option C is wrong because OAuth 2.0 client credentials via Service Bus endpoints is not how Event Grid MQTT authenticates devices; Event Grid uses its own MQTT broker with certificate or Entra ID-based auth.

Full explanation →

61

MCQeasy

Your organization requires that all messages sent to an Azure Service Bus Premium namespace are encrypted using customer-managed keys (CMK) stored in Azure Key Vault. Where must you configure this encryption setting?

A.At the Service Bus Namespace level

B.Inside the Event Grid subscription endpoint URI

C.At the individual Queue or Topic level

D.Within the Azure Function consumer application configuration

AnswerA

Customer-managed key encryption for Service Bus is configured on the namespace itself, where the Key Vault key and managed identity are referenced. Setting it at the namespace level applies the CMK to all queues and topics within that Premium namespace.

Why this answer

Customer-managed key (CMK) encryption for Azure Service Bus is configured at the namespace level, where you specify the Key Vault key and managed identity used to access it. This setting applies to all queues and topics within the namespace, ensuring data at rest is encrypted with your key. Namespace-level configuration is the only supported scope for CMK in Service Bus.

Exam trap

AI-200 often tests whether candidates think encryption can be scoped to individual queues or topics — remember Service Bus CMK is always namespace-level and requires Premium tier.

How to eliminate wrong answers

Option B is wrong because Event Grid subscription endpoint URIs are unrelated to Service Bus encryption; they define where events are delivered, not how Service Bus data is encrypted. Option C is wrong because Service Bus does not support per-queue or per-topic CMK configuration — encryption scope is namespace-wide. Option D is wrong because the consumer application configuration (e.g., Azure Function settings) controls client-side behavior, not the at-rest encryption of the Service Bus namespace.

Full explanation →

62

MCQeasy

You are designing an event-driven AI application that requires routing custom events from an Azure resource to multiple downstream serverless webhooks. Which Azure messaging service should you use to publish and route these events reliably?

A.Azure Service Bus

B.Azure Event Hubs

C.Azure Storage Queues

D.Azure Event Grid

AnswerD

Azure Event Grid is a publish-subscribe service built for event routing, delivering custom events from a source to multiple subscriber webhooks. Its native fan-out and retry handling satisfy the requirement to route events reliably to several downstream serverless endpoints.

Why this answer

Azure Event Grid is a fully managed event routing service designed for event-driven architectures. It natively supports custom events published to a topic, and can route them to multiple subscribers—including serverless webhooks—via event subscriptions. It provides reliable delivery with retries, dead-lettering, and filtering, making it the ideal choice for routing custom events to multiple downstream webhooks.

Exam trap

AI-200 often tests the confusion between Event Grid, Event Hubs, and Service Bus: candidates may incorrectly choose Service Bus because it supports topics and subscriptions, but Event Grid is the only service that natively pushes events to multiple webhooks with built-in filtering and retry.

How to eliminate wrong answers

Option A is wrong because Azure Service Bus is a message broker for enterprise messaging patterns (queues, topics with subscriptions) but it is not designed for lightweight event routing to webhooks; it requires consumers to poll or use the SDK, and does not natively push to HTTP endpoints without additional code. Option B is wrong because Azure Event Hubs is a big data streaming platform optimized for high-throughput telemetry ingestion, not for routing discrete custom events to multiple webhooks; it lacks native webhook push and event filtering. Option C is wrong because Azure Storage Queues is a simple queue service for asynchronous messaging between components, but it does not support publish-subscribe fan-out to multiple subscribers, nor does it push events to webhooks.

Full explanation →

63

MCQmedium

You are managing an AKS cluster running resource-intensive AI training jobs. You want to ensure that nodes automatically scale up and down based on pending pod resource requests. Which component should you enable and configure?

A.KEDA (Kubernetes Event-driven Autoscaling)

B.Azure Load Balancer

C.Horizontal Pod Autoscaler

D.Kubernetes Cluster Autoscaler

AnswerD

The Cluster Autoscaler watches for pods that cannot be scheduled due to insufficient node resources and adds nodes to the node pool, then removes underused ones. This directly satisfies the stem's requirement for automatic scale up and down driven by pending pod resource requests.

Why this answer

The Kubernetes Cluster Autoscaler is the component that adds or removes nodes in an AKS node pool based on pending pods that cannot be scheduled due to insufficient resources. It watches for unschedulable pods and scales the node pool up, then scales down underutilized nodes. This directly matches the requirement of scaling nodes based on pending pod resource requests.

Exam trap

AI-200 often tests the confusion between HPA (scales pods) and Cluster Autoscaler (scales nodes) — candidates pick HPA because the question mentions 'scaling' and 'resource requests' without noticing the word 'nodes'.

How to eliminate wrong answers

Option A is wrong because KEDA scales workloads (pods) based on external event sources like queues or Kafka, not the number of nodes in the cluster. Option B is wrong because Azure Load Balancer distributes traffic to pods and has no role in node provisioning or scaling. Option C is wrong because the Horizontal Pod Autoscaler adjusts replica counts of a deployment based on CPU/memory/custom metrics, but it cannot add nodes — if no node has capacity, HPA-created pods stay Pending.

Full explanation →

64

MCQeasy

You are developing a serverless AI notification workflow. When an AI model finishes training, it publishes an event to an Azure Event Grid topic. You want to trigger an Azure Logic App when this event occurs. Which Event Grid subscription event delivery schema and endpoint type should you select?

A.Select 'Webhook' as the endpoint type and provide the Logic Apps HTTP Request URL.

B.Select 'Storage Queue' as the endpoint type.

C.Select 'Azure Service Bus Queue' as the endpoint type and provide the queue connection string.

D.Select 'Azure Event Hubs' as the endpoint type and provide the connection string.

AnswerA

Logic Apps exposes an HTTP Request trigger endpoint, so subscribing with endpoint type Webhook and supplying that URL lets Event Grid POST the model-training event directly into the workflow, satisfying the trigger requirement without extra relay components.

Why this answer

Azure Logic Apps expose an HTTP-triggered endpoint (the 'When an HTTP request is received' or Event Grid trigger URL) that Event Grid can invoke directly. Selecting 'Webhook' as the endpoint type and supplying the Logic App's HTTP Request URL lets Event Grid POST the event payload to the Logic App, which then parses it and runs the workflow. This is the standard, first-class integration pattern for Event Grid → Logic Apps.

Exam trap

AI-200 often tests whether candidates confuse Event Grid's push-based reactive notification model with Event Hubs' pull-based streaming model, leading them to pick Event Hubs as the endpoint type for a Logic App trigger.

How to eliminate wrong answers

Option B is wrong because a Storage Queue endpoint writes the event as a message into an Azure Storage Queue, which a Logic App would have to poll separately rather than being triggered reactively by the event. Option C is wrong because a Service Bus Queue endpoint delivers events into Service Bus for a Service Bus consumer to process — it does not directly trigger a Logic App and adds an unnecessary intermediary. Option D is wrong because Event Hubs is a high-throughput streaming ingestion service, not a discrete event notification endpoint, and it would not trigger a Logic App workflow on a single Event Grid event.

Full explanation →

65

MCQhard

You are designing a high-availability RAG architecture where search queries must succeed even if an entire Azure region experiences an outage. You deploy Azure AI Search in a primary region and a secondary region. How should client applications handle failover?

A.Hardcode the secondary search IP address in client application configuration files

B.Rely on Cosmos DB automatic failover to replicate search indices

C.Use Azure Traffic Manager or Azure Front Door in front of regional search service endpoints with health probes

D.Configure SQL replication between search indexes

AnswerC

Azure Traffic Manager and Azure Front Door perform DNS or anycast routing with health probes, automatically redirecting client traffic to the secondary Azure AI Search endpoint when the primary region fails. This satisfies the stem's requirement that queries succeed despite a full regional outage, without client-side failover logic.

Why this answer

Azure Traffic Manager and Azure Front Door are the correct global load-balancing services to place in front of regional Azure AI Search endpoints, using health probes to detect regional outages and route client traffic to a healthy secondary region. Traffic Manager operates at the DNS layer with priority or performance routing, while Front Door provides anycast-based Layer 7 routing with faster failover and additional WAF/TLS offload. Both support health probe configuration that automatically removes an unhealthy regional endpoint from rotation.

Exam trap

AI-200 often tests whether candidates understand that Azure AI Search has no built-in cross-region replication, so they mistakenly assume Cosmos DB or SQL replication can replicate search indexes.

How to eliminate wrong answers

Option A is wrong because hardcoding a secondary IP address in client configuration files does not provide automatic failover, requires manual intervention, and breaks when the secondary endpoint's IP changes. Option B is wrong because Cosmos DB automatic failover replicates Cosmos DB data, not Azure AI Search indexes — search indexes are a separate service and are not replicated by Cosmos DB. Option D is wrong because SQL replication is a relational database technology and has no relationship to Azure AI Search index replication; search indexes are not SQL databases.

Full explanation →

66

MCQmedium

Your organization uses Azure Service Bus Topics. You need to ensure that messages published to a topic are delivered to subscriptions in a specific priority order (e.g., high priority messages processed before normal priority). What is the recommended Service Bus design pattern to achieve this?

A.Create separate queues or subscriptions for high-priority and normal-priority messages, and have workers poll the high-priority entity first.

B.Set the Priority property on the Service Bus message header to 99.

C.Configure Event Hubs partition key hashing to group priority messages.

D.Enable Event Grid priority filters on the topic.

AnswerA

Service Bus cannot reorder messages by priority within a single subscription, so separate entities per priority level let workers drain the high-priority queue first. This satisfies the stem's requirement for priority-ordered processing, since competing consumers on one entity would not guarantee ordering.

Why this answer

Service Bus does not natively support message priority ordering, so the recommended pattern is to create separate queues or subscriptions for each priority level and have consumers drain the high-priority entity first. This gives deterministic priority handling because the broker processes each entity independently and the consumer controls polling order. It is the standard workaround for the absence of a built-in priority property.

Exam trap

AI-200 often tests whether candidates invent a non-existent 'Priority' property on Service Bus messages — the correct answer is always the separate-entity pattern because Service Bus has no native priority field.

How to eliminate wrong answers

Option B is wrong because Service Bus does not expose a settable Priority property on message headers — this is a fictional feature; AMQP has no standard priority field honored by Service Bus. Option C is wrong because Event Hubs partition key hashing is unrelated to Service Bus topics and does not provide priority ordering. Option D is wrong because Event Grid priority filters do not exist — Event Grid supports subject/event-type filters, not priority-based routing.

Full explanation →

67

Multi-Selecthard

You are optimizing an enterprise Azure Cosmos DB for NoSQL vector database. Which THREE administrative or architectural practices help ensure high availability and predictable performance? (Choose three)

Select 3 answers

A.Choose a partition key that evenly distributes data and query load across physical partitions

B.Enable multi-region write replication for global low-latency availability

C.Store all documents in a single partition without a partition key

D.Disable automatic indexing entirely across all properties

E.Provision adequate Request Units (RUs) or configure autoscale throughput

AnswersA, B, E

A well-chosen partition key spreads items and RU consumption evenly across physical partitions, preventing hot partitions that throttle requests and cause unpredictable latency. Even distribution is the foundational requirement for predictable performance and availability in Azure Cosmos DB for NoSQL vector workloads.

Why this answer

Option A is correct because a well-chosen partition key that evenly distributes data and query load across physical partitions prevents hot partitions, which is essential for predictable performance and scalability in Cosmos DB for NoSQL. Option B is correct because enabling multi-region write replication (multi-master) provides global low-latency writes and improves availability by allowing the account to continue serving requests even if a region becomes unavailable. Option E is correct because provisioning adequate Request Units (RUs) or configuring autoscale throughput ensures the database has enough throughput capacity to handle workload demands, preventing throttling (429 errors) and maintaining predictable performance.

Option C is incorrect because storing all documents in a single logical partition without a partition key creates a hot partition and limits scalability, harming both availability and performance. Option D is incorrect because disabling automatic indexing entirely removes the default indexing policy that supports efficient queries, which would degrade query performance rather than improve it.

Exam trap

The trap is thinking 'no partition key' simplifies design; in Cosmos DB it creates a single hot partition and is a classic anti-pattern, while the exam rewards even distribution, multi-region writes, and proper RU provisioning.

Full explanation →

68

MCQeasy

Which Azure AI Search capability allows you to extract text from images and PDF documents during indexer execution using AI cognitive skills?

A.Semantic configurations

B.Scoring profiles

C.Skillsets

D.Vector profiles

AnswerC

A skillset defines the AI enrichment pipeline an indexer runs on each document: OCR to read printed and handwritten text in images, including images inside PDFs, text merge to combine it with the document's own text, plus skills such as language detection, entity recognition, key phrase extraction, text splitting and embedding generation. The indexer needs image extraction enabled for OCR to receive images.

Why this answer

Skillsets in Azure AI Search define a pipeline of cognitive skills (such as OCR, image analysis, entity recognition, and text translation) that run during indexer execution to enrich content. To extract text from images and PDFs, you attach a skillset to the indexer, and skills like OCR or Document Extraction process the content. Semantic configurations, scoring profiles, and vector profiles do not perform content extraction.

Exam trap

AI-200 often tests whether candidates confuse query-time features (semantic configurations, scoring profiles) with index-time enrichment (skillsets) for OCR and document extraction.

How to eliminate wrong answers

Option A is wrong because semantic configurations enable semantic ranking (L1/L2 reranking) on query results, not content extraction during indexing. Option B is wrong because scoring profiles customize relevance scoring (boosting by field, freshness, etc.) and do not extract text. Option D is wrong because vector profiles define vector search algorithms and compression (e.g., HNSW, scalar quantization) and do not perform OCR or document extraction.

Full explanation →

69

Multi-Selectmedium

Your development team is planning to deploy a containerized natural language processing model to Azure Container Apps. Which TWO features are natively supported by Azure Container Apps for managing application lifecycle and traffic? (Choose two.)

Select 2 answers

A.Automatic deployment of bare-metal hypervisors

B.Built-in KEDA-based autoscaling including scaling to zero

C.Native revision management and traffic splitting between revisions

D.Direct root SSH access to individual container instances for interactive debugging

E.Direct manual configuration of control plane Kubernetes master nodes

AnswersB, C

Azure Container Apps integrates KEDA scalers natively, scaling replicas on event sources such as HTTP concurrency or queue depth, and can scale to zero when idle. This satisfies the scenario's lifecycle requirement by removing manual capacity management for the NLP model.

Why this answer

Azure Container Apps natively supports KEDA-based autoscaling, including scale-to-zero, which is option B — this is a core platform capability that lets containerized workloads (such as an NLP model) scale based on event sources like HTTP traffic or queues without managing Kubernetes infrastructure. Option C is also correct because Azure Container Apps provides native revision management, allowing immutable revisions of an app to be created and traffic splitting (for example, weighted percentages) between revisions for blue-green or canary deployments. Option A is incorrect because Azure Container Apps is a serverless container platform and does not deploy or expose bare-metal hypervisors to users.

Option D is incorrect because Azure Container Apps does not provide direct root SSH access to individual container instances; debugging is done via logs, console, or exec into containers without root host access. Option E is incorrect because the Kubernetes control plane is fully managed by Azure and users cannot manually configure master nodes.

Exam trap

AI-200 often tests the misconception that Container Apps exposes Kubernetes control-plane or host-level access, when in fact it is fully abstracted and serverless.

Full explanation →

70

MCQhard

You are setting up image builds for a multi-architecture (AMD64 and ARM64) AI model container using Azure Container Registry Tasks. Which command or feature should you use to build images for both architectures simultaneously?

A.Azure DevOps pipeline running docker push directly

B.az aks create with --node-os-sku

C.az acr build with a multi-step task or docker buildx configuration

D.az acr import

AnswerC

Using `az acr build` with a multi-step task or buildx configuration lets ACR Tasks build AMD64 and ARM64 images concurrently, satisfying the simultaneous multi-architecture requirement. Docker Buildx creates a manifest list, while multi-step tasks orchestrate per-architecture builds in parallel within Azure, avoiding separate sequential runs.

Why this answer

Azure Container Registry Tasks supports multi-architecture image builds through `az acr build` with either a multi-step YAML task or a Dockerfile leveraging `docker buildx` for cross-platform builds (linux/amd64 and linux/arm64). ACR Tasks runs the build in Azure, so you don't need local buildx/QEMU setup, and it can push a single manifest list referencing both architecture variants. This is the native, supported path for producing multi-arch images in ACR.

Exam trap

AI-200 often tests whether candidates confuse image build orchestration (ACR Tasks/buildx) with image distribution (import) or cluster configuration (aks create), causing them to pick a command that moves or configures images rather than builds them.

How to eliminate wrong answers

Option A is wrong because an Azure DevOps pipeline running `docker push` only pushes an already-built image — it does not build for multiple architectures and lacks the buildx/multi-platform orchestration. Option B is wrong because `az aks create --node-os-sku` configures the AKS node pool OS SKU (e.g., Ubuntu, Mariner) and has nothing to do with building multi-arch container images. Option D is wrong because `az acr import` copies an existing image from another registry into ACR; it does not build anything, let alone multi-architecture images.

Full explanation →

71

MCQhard

You are designing an enterprise AI event-driven pipeline. Events from multiple SaaS applications are published to an Azure Event Grid domain. You need to ensure that a rogue tenant cannot exhaust the delivery throughput of other tenants. Which feature should you leverage?

A.Deploy separate Event Grid topics or distinct Event Domains per tenant with dedicated custom access keys or managed identities.

B.Set the maximum delivery retry count to zero for all tenants.

C.Enable Azure DDoS Protection Standard on the storage account dead-letter container.

D.Configure Service Bus partitioned queues in front of the Event Grid domain.

AnswerA

Event Grid applies throttling per topic or domain, so a noisy tenant sharing one domain consumes the shared quota. Isolating tenants into separate topics or domains with dedicated keys or managed identities confines each tenant's throughput, preventing one rogue publisher from starving others.

Why this answer

Deploying separate Event Grid topics or distinct Event Domains per tenant with dedicated access keys or managed identities isolates each tenant's publishing and delivery throughput, preventing a rogue tenant from exhausting shared resources. Event Grid domains allow multi-tenant publishing with per-tenant topics, but true throughput isolation requires separate domains or topics with separate authentication and quotas. This design ensures noisy-neighbor effects are contained.

Exam trap

The trap is thinking that retry settings or DDoS protection solve tenant throughput isolation; candidates must recognize that Event Grid throughput is a shared resource and only separate topics/domains with dedicated authentication provide isolation.

How to eliminate wrong answers

Option B is wrong because setting maximum delivery retry count to zero does not isolate throughput; it only affects retry behavior and could cause event loss, not prevent one tenant from consuming shared capacity. Option C is wrong because Azure DDoS Protection Standard protects against network-layer attacks on public IPs; it does not address Event Grid delivery throughput contention among tenants. Option D is wrong because Service Bus partitioned queues in front of Event Grid do not isolate Event Grid publishing throughput; they add a buffering layer but the Event Grid domain remains a shared resource subject to tenant contention.

Full explanation →

72

MCQmedium

You are designing an application that stores vector embeddings in Azure Cosmos DB for NoSQL. You want to ensure that vectors are stored securely and that all data at rest is encrypted using customer-managed keys (CMK). How is this achieved in Cosmos DB?

A.Enable encryption inside the vector embedding policy JSON definition

B.Encrypt each individual vector array in client application code before inserting

C.Store vectors in Azure Blob Storage with a CMK policy

D.Configure customer-managed keys (CMK) at the Azure Cosmos DB account level referencing Azure Key Vault

AnswerD

Cosmos DB customer-managed keys are configured at the account level, wrapping the account's encryption key with a key held in Azure Key Vault. This satisfies the stem's requirement that all data at rest, including vector embeddings, is encrypted under CMK.

Why this answer

Customer-managed keys (CMK) for Azure Cosmos DB are configured at the account level, referencing an Azure Key Vault. This enables encryption of all data at rest, including vector embeddings, with keys managed by the customer. This is the correct and only way to achieve CMK encryption for Cosmos DB.

Exam trap

AI-200 often tests the misconception that encryption can be configured per vector or in the embedding policy, when in fact CMK is an account-level setting; candidates may confuse client-side encryption with native CMK.

How to eliminate wrong answers

Option A is wrong because the vector embedding policy JSON definition does not include encryption settings; it defines how vectors are generated and indexed. Option B is wrong because encrypting individual vector arrays in client code is application-level encryption, not the same as CMK for data at rest, and does not leverage Azure's native encryption. Option C is wrong because storing vectors in Azure Blob Storage with CMK is a different service and does not apply to Cosmos DB; the question specifies Cosmos DB for NoSQL.

Full explanation →

73

MCQeasy

Your application publishes events to an Azure Event Grid topic. You want to ensure that event publishers must present a valid shared access signature or key in the HTTP request header. Which header name does Event Grid expect for key-based authentication?

A.aeg-sas-key

B.Authorization

C.x-functions-key

D.sb-connection-string

AnswerA

Event Grid accepts key-based publisher authentication through the aeg-sas-key request header, which carries the topic or domain access key. Supplying that header satisfies the stem's requirement that publishers present a valid key in the HTTP request.

Why this answer

Azure Event Grid accepts key-based authentication via the 'aeg-sas-key' HTTP header, which carries the topic or domain access key. Publishers include this header to authenticate without needing an Azure AD token, and Event Grid validates it against the topic's configured keys.

Exam trap

The trap is defaulting to the generic 'Authorization' header because it is the most familiar authentication header — candidates overlook that Event Grid's key-based scheme uses a service-specific header name, aeg-sas-key.

How to eliminate wrong answers

Option B is wrong because 'Authorization' is the standard header for bearer tokens (Azure AD / OAuth 2.0), not for Event Grid's key-based scheme. Option C is wrong because 'x-functions-key' is used by Azure Functions HTTP triggers for function-level or host-level key authentication, not by Event Grid. Option D is wrong because 'sb-connection-string' is not an HTTP header at all — it is a Service Bus connection string used in SDK configuration, and Service Bus is a different service.

Full explanation →

74

MCQmedium

You are deploying a containerized AI model to Azure Container Apps. The model requires a GPU for inference. You configure the container app to use a workload profile with GPU support. However, when the app starts, it fails with an error indicating that the GPU is not available. You need to ensure the container can access the GPU. What should you do?

A.Set the environment variable `NVIDIA_VISIBLE_DEVICES=all` in the container app configuration.

B.Deploy the container to Azure Kubernetes Service (AKS) instead, because Azure Container Apps does not support GPU workloads.

C.Use a workload profile that includes GPU resources and ensure the container app is configured to use that profile.

D.Mount a hostPath volume from the underlying node to the container to expose the GPU device.

AnswerC

Azure Container Apps supports GPU-enabled workload profiles for specialized hardware. To access a GPU, the container app must be assigned to a workload profile that includes GPU resources, such as the `Consumption-GPU` or a dedicated GPU profile. This ensures the container is scheduled on a node with a GPU, making it available to the application.

Why this answer

Azure Container Apps provides GPU support via specialized workload profiles. To enable GPU access, you must select a workload profile that includes GPU resources and assign it to the container app. This ensures the platform schedules the container on a node with a GPU.

Other approaches like environment variables or hostPath mounts do not provision GPU hardware in this managed environment.

Exam trap

The trap here is assuming that setting environment variables or mounting devices is sufficient to access a GPU, when the platform requires a GPU-enabled workload profile.

Full explanation →

75

Multi-Selectmedium

Which TWO of the following steps are required to enable GPU support for a pod in AKS?

Select 2 answers

A.Use a node pool with GPU-enabled VMs.

B.Enable the 'Privileged' flag in the Dockerfile.

C.Include the 'nvidia.com/gpu' resource request in the pod.

D.Set the pod to run as root.

E.Install the NVIDIA driver on the local machine.

AnswersA, C

GPU workloads require nodes with physical NVIDIA hardware, so the AKS cluster must include a GPU-enabled node pool (such as NC or ND series VMs). The NVIDIA device plugin then exposes those GPUs as schedulable 'nvidia.com/gpu' resources.

Why this answer

Option A is correct because GPU workloads in AKS can only be scheduled onto nodes backed by GPU-enabled VM sizes (for example NC, ND, or NV series), so the cluster must contain a GPU node pool. Option C is correct because the pod spec must request the GPU resource using the extended resource name 'nvidia.com/gpu' (for example, resources.limits: nvidia.com/gpu: 1), which is how the Kubernetes device plugin advertises and allocates GPUs to the container. Option B is incorrect because the Privileged flag in a Dockerfile is unrelated to GPU enablement and is not required for GPU scheduling.

Option D is incorrect because running the pod as root is not a prerequisite for GPU access in AKS. Option E is incorrect because the NVIDIA drivers are installed and managed by AKS on the GPU nodes, not on the local client machine used to submit the pod.

Exam trap

AI-200 often tests the misconception that GPU support requires host-level driver installation or privileged containers, when in fact AKS manages drivers via the device plugin and the only pod-side requirement is the nvidia.com/gpu resource request.

Full explanation →

Page 1 of 6

All pages

Practice AI-200 by domain

Target a specific domain to shore up weak areas.

Security And Observability Event Driven Integration Data Management Services And Vector Search Containerized AI Workloads

See all domains with question counts →